Relay: agent leases cannot authorize private DMs with ephemeral channel IDs

## Observed behavior

`POST /agent/leases` authorizes an invocation only when the target agent's kind:10100 `channel_ids` contains the source channel UUID. That works for declared shared rooms, but a private human↔agent DM has an ephemeral channel UUID created after the profile is published. A correctly addressed kind:9 (`h` channel + `p` agent), with both principals active channel members, is denied before dispatch with `agent profile does not allow this channel`.

## Why this is a protocol gap

A static card cannot enumerate a future private-DM UUID. Treating every private channel as allowed would be unsafe; the intended capability must remain explicit and the existing membership and requester-policy checks must remain authoritative.

## Proposed fail-closed shape

Add an explicit boolean kind:10100 card field, e.g. `accept_direct_messages`. When it is true, permit the lease only when all of these hold:

1. the source channel metadata says `channel_type == "dm"` and `visibility == "private"`;
2. the existing requester policy (`respond_to`) allows the requester;
3. both requester and target agent are active members of that exact channel;
4. existing agent-to-agent loop prevention remains in force.

Keep static `channel_ids` required for all non-DM channels, and default a missing field to false.

## Acceptance cases

- Explicit capability + valid private DM + bilateral membership: lease may be issued.
- Same profile in any non-DM channel: denied unless that channel is explicitly listed.
- Missing/false capability, missing member, or agent requester: denied.

This enables mobile direct chat with a relay-hosted agent without making the community operator a reader of the private DM.

Start at the POST /agent/leases authorization path and trace the existing channel_ids, respond_to, membership, and agent-to-agent loop-prevention checks. Add the explicit kind:10100 capability with a false default, then verify the listed private-DM and non-DM acceptance cases, including denials for missing membership or agent requesters.

Written by the indexing model from the issue text.