Peering: authenticate peer relays with NIP-42 using the relay's own keypair

Part of the relay peering work in #931.

Scope

Give nostream a relay identity it can prove to other relays, and a way to verify theirs:

The relay holds its own keypair (the self identity in its NIP-11 document), stored in settings/secrets like other credentials.
As a peer (outbound), nostream authenticates to a source relay via NIP-42 AUTH signed with the relay keypair.
As a source (inbound), nostream verifies AUTH signatures against a configured list of peer pubkeys — peers are configured by pubkey, not by URL alone.
The authenticated peer pubkey is attached to the connection state for the peer-aware handling that builds on it.

A nostream instance can AUTH to another relay as its self pubkey, and the receiving side can verify it.
Connections from unconfigured pubkeys receive no peer recognition, even with a valid signature.
Relay keypair generation/storage is documented; the private key never leaves the relay.