Peering: authenticate peer relays with NIP-42 using the relay's own keypair #933

Part of the relay peering work in #931.

Scope

Give nostream a relay identity it can prove to other relays, and a way to verify theirs:

• The relay holds its own keypair (the self identity in its NIP-11 document), stored in settings/secrets like other credentials.
• As a peer (outbound), nostream authenticates to a source relay via NIP-42 AUTH signed with the relay keypair.
• As a source (inbound), nostream verifies AUTH signatures against a configured list of peer pubkeys — peers are configured by pubkey, not by URL alone.
• The authenticated peer pubkey is attached to the connection state for the peer-aware handling that builds on it.

Acceptance

• A nostream instance can AUTH to another relay as its self pubkey, and the receiving side can verify it.
• Connections from unconfigured pubkeys receive no peer recognition, even with a valid signature.
• Relay keypair generation/storage is documented; the private key never leaves the relay.