docs: operator console guide + fix example recipes + document all env vars

- New docs/operations/CONSOLE.md: reaching /admin, NIP-98 login, the
  defaults->env->DB precedence model, per-section runtime-safe vs
  restart-required table, expected_versions concurrency, restart_apply_mode
  (with the systemd Restart=always requirement for auto), clearing a DB
  override. Linked from README + OPERATOR_SETUP.
- All six example recipes gained an explicit chain-enablement block
  (FEATURE_XMR/WOW on, BTC/LTC/GRIN off) so they no longer hard-fail
  Config::validate in production (default-on chains with empty sources).
- Documented all 16 previously-undocumented env vars in .env.example
  (RESTART_APPLY_MODE, TOR_ADMIN_ONION, DEPLOYMENT_MODE, TIP_SHARE_BASE_URL,
  ...); RELAY.md gained the premium-post policy + RELAY_WRITE_ALLOWLIST_NPUBS;
  ADMIN_PUBKEYS noted as reserved/inert.

README.md

@@ -72,6 +72,10 @@ Operator/admin functions live on a **separate loopback listener** (front it with
 Tor or an SSH tunnel) — confidentiality by socket, never merged into the public
 router or OpenAPI.
 
+- **Operator Console**: an embedded single-page app served at `/admin` on the
+  loopback admin plane. Sign in with your admin key, then review status, manage
+  admin keys and invite codes, and edit the runtime config overlay (env plus a
+  validated DB layer). Guide: [docs/operations/CONSOLE.md](docs/operations/CONSOLE.md).
 - **Sign-in-with-Smirk admin auth** — a NIP-98 *signed action* over a single-use
   nonce (AUTHN) + a MAC-protected key allowlist (AUTHZ), composed so a route can't
   run without both.