web: repository browser resolves kind:30618 refs without filtering by relay pubkey

## What's wrong

\`web/src/features/repos/use-repo-refs.ts\` resolves git ref events (kind:30618) without filtering by the relay's own pubkey. The file has a TODO/comment acknowledging this at the exact lines flagged below.

## Impact

Any pubkey can publish a kind:30618 event claiming to be a ref for a repo it doesn't own, and the repo browser will display it as if it were authoritative — a ref-spoofing gap.

## Location

`web/src/features/repos/use-repo-refs.ts:54,56` (existing TODO comment already documents the gap).

## Fix

Scope the query/filter to the relay's own pubkey (or the repo owner's pubkey, whichever is the intended authority for kind:30618 in this repo's NIP), matching how other addressable-event lookups in this codebase are scoped.

## Provenance

Found during a documentation-corpus review of `launchpad/docs/corpus/platforms/web/repository-browser.md` (launchpad-26/buzz PR #1981).