release(v4.8.4): server-side cross-channel dedup via BridgeDeliveryLog

V4.8.3 shipped client-side cross-channel dedup hook
(`Inbox.acceptBridgeFrame`), but recipients that didn't migrate to
the new wiring still observed the same envelope twice — once via
WS bridge push, again ~30 s later via inbox-poll. Prism re-verified
the FR after 4.8.3 and asked for a relay-side enforcement so app
code doesn't have to ack-via-DELETE on every bridge frame.

V4.8.4 adds an in-memory `BridgeDeliveryLog` (default 60 s grace,
8192-per-address cap) that records every successful WS / SSE /
long-poll push of `(address, msgId)`. The `/v1/inbox/:addr/fetch`
route filters out blobs in the log's grace window so a recipient
running both a bridge and the 30 s poll cadence sees exactly one
delivery. Cursor advances over the full fetched window so a poll
that straddles a suppressed blob doesn't stall.

The standalone server auto-wires the log between
`createBridgeRoutes` and `createInboxRoutes`. Custom mounts thread
the same instance through `bridgeDeliveryLog` on both factories.

Tests cover WS-then-poll, SSE-then-poll, and a negative control
(non-bridge-pushed blob still comes through inbox-fetch).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/shade-server/src/standalone.ts

@@ -182,22 +182,26 @@ app.route(
     ...(kt ? { keyTransparency: kt } : {}),
   }),
 );
-app.route(
-  '/',
-  createInboxRoutes(inboxStore, crypto, {
-    events: inboxEvents,
-    disableRateLimit,
-  }),
-);
-
 // V3.7 transport-bridge — SSE / long-poll / WS fallbacks for the inbox.
-// Held as a top-level reference so the WebSocket handler can be passed to
-// Bun.serve below.
+// Created BEFORE the inbox routes so the shared bridge-delivery log can
+// be wired into both. The log is the cross-channel dedup gate that lets
+// the inbox-fetch route skip blobs already pushed via bridge — see
+// V4.8.4 changelog and the Prism FR
+// `cross-channel-duplicate-fanout-v4.8.2.md`.
 const bridgeRoutes = createBridgeRoutes({
   store: inboxStore,
   crypto,
   events: inboxEvents,
 });
+
+app.route(
+  '/',
+  createInboxRoutes(inboxStore, crypto, {
+    events: inboxEvents,
+    disableRateLimit,
+    bridgeDeliveryLog: bridgeRoutes.bridgeDeliveryLog,
+  }),
+);
 app.route('/', bridgeRoutes.app);
 
 // ─── Optional: Observer + Dashboard ──────────────────────────