feat(relay): OPERATOR/MODERATOR role model for relay admin API with NIP-98 auth

[wpfleger96]

Replaces the BUZZ_ADMIN_INSECURE_NO_AUTH / BUZZ_ADMIN_PUBKEYS model with a two-tier principal model backed by config union + DB, gated by NIP-98 HTTP auth. Phases 1 and 2 of Plan v4 (Thufir-reviewed spec).

What changed

Authentication (BUZZ_ADMIN_AUTH)

Replaces the deleted BUZZ_ADMIN_INSECURE_NO_AUTH=true variable with BUZZ_ADMIN_AUTH accepting token (default), disabled, or nip98. Startup fails closed on missing/malformed configuration.

Principal resolution (NIP-98 mode)

resolve_admin_principal() returns AdminPrincipal { pubkey, role, source }:

• Operator/Config — pubkey ∈ RELAY_OPERATOR_PUBKEYS
• Operator/OwnerFallback — pubkey == RELAY_OWNER_PUBKEY and RELAY_OPERATOR_PUBKEYS is empty (config-evaluated, never from runtime DB rows)
• Operator or Moderator / Db — row in the relay_operators table
• No match → 403

Config always outranks DB. None never falls through as a role.

Token/disabled mode

Read routes work in all modes. Mutation and staffing routes require nip98; token/disabled modes receive 403 from require_mutation_principal.

Phase 2: report resolution

POST /reports/{id}/resolve — enforcement state machine with idempotency:

• Decision-only: dismiss/escalate — CAS open→terminal + audit row in one transaction.
• Enforcement: delete/kick/ban/timeout — claims report (open→processing), runs durable mutation, finalizes to resolved. Crash-safe: re-drive picks up at the step marker and converges to exactly-one enforcement.

PATCH /feedback/{id} — update product_feedback.status (new|reviewed|archived). Requires nip98.

Phase 2: staffing endpoints

GET/PUT/DELETE /operators/{pubkey} — Operator-only. PUT/DELETE against a config-backed pubkey returns 409 Conflict. GET /operators returns the union of config and DB with per-entry source attribution.

Probe endpoint

GET /probe — auth-mode, role, source, canAct, canStaff discovery for the desktop console.

Migrations

• 0029_relay_operators.sql — relay_operators table (deployment-global; registered in _operator_global_tables), actor_authority column on moderation_actions, processing status + active_action_id on moderation_reports, status column on product_feedback.
• 0030_relay_admin_actions.sql — relay_admin_actions enforcement-action table with request_id idempotency key and step_marker for crash recovery.

Documentation

docs/admin/README.md rewritten to document the full principal model, NIP-98 event requirements (including query string, method tag, payload tag for body mutations), owner fallback B semantics, role/source table, capabilities by role, roster management, and startup error matrix.

Tests

915 unit tests pass. 10 ignored (requires Postgres). 7 pre-existing failures (6 media tests + 1 telemetry flake) that also fail on origin/main without a local DB.

[kalvinnchau]

Re-reviewed at d014e40. The fail-closed config contract, constant-time bearer validation, host/origin ordering, insecure network-boundary mode, dashboard token lifecycle, authenticated attachment fetches, and CSP/static routing are coherent and covered. Deployment dependency is external: land bb-public#339 and wait for Argo rollout before deploying this relay image.