js: strict receiver validation per BBQr BIP draft

[scgbckbone]

No description provided.

[scgbckbone]

@siim-m please check this "vibe"

[nvk]

The existing JavaScript suite and build pass (19 tests), and I also checked the draft's 4 positive and 13 negative vectors. The parser changes mostly behave as intended, but the Z path still has two blocking conformance/security gaps. Please also add regression tests for the new validation branches; this PR currently changes parser behavior without adding tests.

[scgbckbone]

Both P1s addressed in f5ebcb5. Tests are now committed: js/tests/vectors.test.ts runs the draft's 4 positive vectors (forward + reverse order), all 14 negative vectors, plus the two new Z regression cases. Full suite: 39 passed, tsc clean. Same hardening + tests applied to the python PR (#21).

[nvk]

The streaming 16 MiB output cap is fixed, and the expanded suite/build pass (39 tests, TypeScript and Vite clean). Two conformance issues remain: the 1 KiB distance bound is still approximate rather than exact, and the public BIP vector file has reintroduced a duplicate-policy case that draft v4 intentionally removed from the normative negative set.

[siim-m]

@scgbckbone I can't seem to find the actual BIP draft anywhere, so cannot really review against the spec itself. But from what I can infer, just a few minor things.