fix(core): tear down shares on forget/block and fail-closed blocks

Cancel targeted protocol shares synchronously before await, and treat block
lookup errors as denied so store failures cannot admit blocked peers.

Co-authored-by: Cursor <cursoragent@cursor.com>

crates/vnidrop/src/device_relationship/mod.rs

@@ -129,10 +129,11 @@ impl DeviceRelationshipService {
     }
 
     pub(super) async fn is_blocked(&self, endpoint_id: &str) -> bool {
+        // Fail closed: a store error must not admit blocked traffic.
         self.contacts()
             .is_blocked(endpoint_id)
             .await
-            .unwrap_or(false)
+            .unwrap_or(true)
     }
 
     /// Drop orphaned relationship grant secrets and disable rows whose secrets are gone.