docs(relay): packaging (deploy/relay) + operator guide + .env.example

Completes the operator side of the relay integration:

- deploy/relay/: reference docker-compose + config.toml for a locked-down
  nostr-rs-relay wired to the backend's gRPC admission (host networking so the
  loopback admission socket stays private). Clearly marked a template to pin/
  verify against the operator's nostr-rs-relay version.
- docs/operations/RELAY.md: what it is (inbox relay, not the only relay), the
  admission architecture, the three write policies + NIP-13 PoW, bundled vs
  external, verification, and the seam's modularity. Linked from OPERATOR_SETUP.
- .env.example: the RELAY_* block (all off/placeholder).

Backend relay integration (config → seam → policy → gRPC admission →
capabilities → NIP-05 → packaging/docs) is now complete. Client DM stack next.

.env.example

@@ -133,6 +133,32 @@ PRICES_FETCH_INTERVAL_SECS=300
 # Tips are parked for the conditional-transfer redesign; off until that lands.
 FEATURE_TIPS=false
 
+# ── Nostr relay (optional messaging plane; see docs/operations/RELAY.md) ────
+# Off by default. When on, the operator runs a relay (the packaged
+# nostr-rs-relay under deploy/relay, or an external one) that this backend
+# advertises (/capabilities + NIP-05) and write-restricts via a gRPC admission
+# service. It is the user's DM INBOX, never the only relay — clients also use the
+# public interop relays. Self-hosting concern.
+RELAY_ENABLED=false
+# bundled (run deploy/relay's nostr-rs-relay) | external (point at your own).
+RELAY_MODE=bundled
+# Public ws(s):// URL clients connect to (wss required in production).
+RELAY_URL=
+# Write policy the admission service enforces:
+#   inbox-outbox     — registered npubs publish their own events; anyone may
+#                      deliver a gift-wrapped DM (kind 1059) to a registered user.
+#   author-allowlist — only registered npubs may publish anything.
+#   open             — accept everything (relay resource caps still apply).
+RELAY_WRITE_POLICY=inbox-outbox
+# NIP-13 proof-of-work bits required on cross-ecosystem (non-registered-author)
+# inbound events; 0 disables the PoW gate.
+RELAY_INBOUND_POW_BITS=0
+# Loopback address the gRPC event-admission service binds (the relay calls it).
+# Keep it loopback; the bundled compose reaches it via the host network.
+RELAY_ADMISSION_BIND=127.0.0.1:8090
+RELAY_MAX_EVENT_BYTES=65536
+RELAY_RETENTION_DAYS=30
+
 # ── Admin surface (see docs; default posture is loopback/Tor) ──────────────
 # Admin auth is "Sign in with Smirk": only admin PUBLIC keys are stored here,
 # never a seed or private key. The allowlist is mutated CLI/loopback-only in v1.