fix(relay): harden admission (fail-safe, loopback-only, bounded, size cap) [review]

Adversarial review of the relay admission surface:

- FAIL-SAFE on admission death: nostr-rs-relay fails OPEN if its gRPC admission
  server is unreachable, so a dead admission = an unrestricted relay. The backend
  now EXITS if the admission service stops (supervisor restarts a clean pair);
  documented in RELAY.md. Pin the relay image to a digest (compose note).
- Registration-oracle protection: validate() now refuses a non-loopback
  RELAY_ADMISSION_BIND unless RELAY_ADMISSION_ALLOW_PUBLIC=true (+ test).
- No N+1 on crafted events: recipient p-tags are capped (20, deduped) and resolved
  in ONE batched query (db.any_registered_npub) instead of one-per-tag.
- Defence-in-depth size cap: admission denies events over max_event_bytes before
  any DB work (the relay enforces its own limit too).
- Docs: RELAY.md Security section (fail-open, loopback oracle, default PoW=0 spam
  footgun, client sender-verification); config.toml relay port 8088 (not 8080);
  Docker Hub image; .env.example RELAY_ADMISSION_ALLOW_PUBLIC.

Note: the client-side sender-impersonation blocker is fixed separately in the
monorepo (verifying gift-wrap unwrap).

.env.example

@@ -154,8 +154,12 @@ RELAY_WRITE_POLICY=inbox-outbox
 # inbound events; 0 disables the PoW gate.
 RELAY_INBOUND_POW_BITS=0
 # Loopback address the gRPC event-admission service binds (the relay calls it).
-# Keep it loopback; the bundled compose reaches it via the host network.
+# It answers "is this npub registered?" (a registration oracle) so it MUST stay
+# loopback; the bundled compose reaches it via the host network.
 RELAY_ADMISSION_BIND=127.0.0.1:8090
+# Allow a NON-loopback admission bind (advanced; e.g. a relay container without
+# host networking). Off by default; you must firewall it if you enable it.
+RELAY_ADMISSION_ALLOW_PUBLIC=false
 RELAY_MAX_EVENT_BYTES=65536
 RELAY_RETENTION_DAYS=30