docs(auth_wire): fix doc drift — tests are in-module, P5 grep-lint not yet shipped

Eva [11] code-verify catch: two docstrings in auth_wire.rs referenced state
that doesn't exist on this branch.

- AuthErrorWireCategory::message pointed at "tests/auth_error_payload_oracle.rs"
  for the byte-identity property test. The tests are actually in-module
  (#[cfg(test)] mod tests at the bottom of auth_wire.rs); no separate file
  exists. Updated to name the two specific tests that prove the invariant
  (verification_class_all_coalesce, internal_two_communities_byte_identical).

- auth_error_wire's docstring said "the CI grep-lint enforces" — but the
  grep-lint (P5 in the audit note) is a planned follow-up, not yet shipped.
  Replaced with an accurate description of what actually fences regressions
  today: the wildcard-free match arm. Adding any AuthError variant fails to
  compile here until a wire-class decision is made — that catches the cause,
  not just the symptom. P5 grep-lint is correctly described as planned
  belt-and-suspenders, not currently in CI.

Doc-only diff. No behavior change.

Validation:
- cargo fmt -p buzz-relay --check ✅
- cargo test -p buzz-relay --lib auth_wire ✅ (6/6 property tests green)

Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>

crates/buzz-relay/src/auth_wire.rs

@@ -70,8 +70,9 @@ impl AuthErrorWireCategory {
     /// Stable, byte-identical user-visible message for this category.
     ///
     /// Two `AuthError` values that map to the same category MUST produce the
-    /// same bytes here — that's the property-test invariant in
-    /// `tests/auth_error_payload_oracle.rs`.
+    /// same bytes here — that's the property-test invariant proved in the
+    /// in-module `#[cfg(test)] mod tests` below (see
+    /// `verification_class_all_coalesce` and `internal_two_communities_byte_identical`).
     pub fn message(self) -> &'static str {
         match self {
             // Coalesces Nip98Invalid, Nip98Replay, InvalidSignature,
@@ -102,9 +103,13 @@ impl AuthErrorWireCategory {
 /// Map an [`AuthError`] to its wire category.
 ///
 /// **Do not stringify `AuthError` for the wire by any other path.** This
-/// function is the only sanctioned conversion; the CI grep-lint enforces
-/// that no other call site uses `auth_err.to_string()` or `format!("{}", auth_err)`
-/// in a response-construction chain (P5).
+/// function is the only sanctioned conversion. The load-bearing fence is
+/// the wildcard-free match below: adding any new `AuthError` variant fails
+/// to compile here until a wire-class decision is made — that catches the
+/// cause (a new variant lacks a wire class), not just the symptom (raw
+/// stringification). A `scripts/check-no-authror-leak.sh` grep-lint (P5 in
+/// the audit note) is planned as a belt-and-suspenders follow-up but is
+/// not yet wired into CI.
 pub fn auth_error_wire(err: &AuthError) -> AuthErrorWireCategory {
     match err {
         // Verification class — coalesce.