docs: operator console guide + fix example recipes + document all env vars

- New docs/operations/CONSOLE.md: reaching /admin, NIP-98 login, the
  defaults->env->DB precedence model, per-section runtime-safe vs
  restart-required table, expected_versions concurrency, restart_apply_mode
  (with the systemd Restart=always requirement for auto), clearing a DB
  override. Linked from README + OPERATOR_SETUP.
- All six example recipes gained an explicit chain-enablement block
  (FEATURE_XMR/WOW on, BTC/LTC/GRIN off) so they no longer hard-fail
  Config::validate in production (default-on chains with empty sources).
- Documented all 16 previously-undocumented env vars in .env.example
  (RESTART_APPLY_MODE, TOR_ADMIN_ONION, DEPLOYMENT_MODE, TIP_SHARE_BASE_URL,
  ...); RELAY.md gained the premium-post policy + RELAY_WRITE_ALLOWLIST_NPUBS;
  ADMIN_PUBKEYS noted as reserved/inert.

examples/friends/.env.example

@@ -45,6 +45,19 @@ RELAY_WRITE_POLICY=inbox-outbox
 RELAY_INBOUND_POW_BITS=0
 RELAY_ADMISSION_BIND=127.0.0.1:8090
 
+# ── Chains: enable ONLY what this recipe wires up ────────────────────────────
+# FAIL-CLOSED RULE: in production, an ENABLED chain with no source configured makes
+# the server REFUSE TO BOOT. Every FEATURE_* chain defaults to true, so this recipe
+# turns off the chains it does not wire up. It wires up Monero + Wownero (the
+# XMR_/WOW_ blocks below); fill their *_LWS_ADMIN_KEY and it boots. To add BTC/LTC
+# (electrum URL) or GRIN (GRIN_OWNER_API_SECRET + wiring), configure the source
+# first, THEN flip its flag to true.
+FEATURE_XMR=true
+FEATURE_WOW=true
+FEATURE_BTC=false
+FEATURE_LTC=false
+FEATURE_GRIN=false
+
 # Chain endpoints — point at your own nodes / LWS. See ../../.env.example.
 XMR_LWS_URL=
 XMR_LWS_ADMIN_URL=