fix(relay): close F6 replay K_content nonce reuse via per-generation epoch-in-key

The recoverable replay key was stable per (hostContentSecret, sessionId) while the
agent-side sealer resets its deterministic-nonce seq to 0 on every restart/re-attach
→ two sealer generations sealed distinct plaintext under the SAME (key, nonce).

Add a required 'epoch' to ReplayKeyParams, fold it into the K_content HKDF salt
(sessionId U+001F epoch), mint a fresh epoch per createReplaySealer generation and
expose it, and thread it through ReplaySource so the browser re-derives the matching
key. Fresh epoch per generation ⇒ fresh key ⇒ seq=0 can never collide; recoverability
within a generation is preserved.

Touches relay-contracts/relay-e2e/agent/relay-web. Green: contracts 81, e2e 78,
agent 133, web 99; tsc clean. Regression proves same seq-0 nonce, different key.

relay-web/test/preview-grid.test.ts

@@ -27,9 +27,16 @@ function host(sub: string): HostRecord {
   }
 }
 
+const EPOCH = 'gen-1' // FIX 3b / F6: per-generation key diversifier (seal + declare under the same one).
+
 function sealed(sessionId: string, secret: Uint8Array, line: string): ReplaySource {
-  const k = deriveContentKey({ hostContentSecret: secret, sessionId, alg: ALG })
-  return { sessionId, alg: ALG, frames: [encodeEnvelope(sealReplayFrame(k, 0n, new TextEncoder().encode(line)))] }
+  const k = deriveContentKey({ hostContentSecret: secret, sessionId, alg: ALG, epoch: EPOCH })
+  return {
+    sessionId,
+    alg: ALG,
+    epoch: EPOCH,
+    frames: [encodeEnvelope(sealReplayFrame(k, 0n, new TextEncoder().encode(line)))],
+  }
 }
 
 function fakeApi(hosts: readonly HostRecord[]): ApiClient {