docs(examples): operator cookbook — six deployment recipes + premium-relay spec

Add ready-to-run .env + README recipes (personal, public-free, friends,
paid-access, paid-relay, community) and the premium-relay design overview,
with audit fixes to the config template and spec:

- Drop the inert INSTANCE_ID knob (config never read it) and document the real
  per-node id, which is derived from ADMIN_PUBLIC_URL.
- Warn that a placeholder PUBLIC_API_URL is rejected at boot in production
  (Nostr identity is on by default); soften the recipe "boots today" status.
- Remove dead template vars: BTC/LTC Core-RPC settings and the non-existent
  PUBLIC_EXPOSE_FEATURES (replaced with the real per-field landing switches).
- Mark ALTCHA_HMAC_KEY conditional in PoW-off recipes; blank placeholder
  payment creds so a recipe doesn't ship a key that fails validation.
- Fix premium-relay spec drift: the migration creates no premium_until index,
  disabled endpoints return 400/200 (not 404), and neutralize operator voice.

.env.example

@@ -6,14 +6,13 @@
 # ── Server ────────────────────────────────────────────────────────────────
 SERVER_HOST=0.0.0.0
 SERVER_PORT=8080
-# Public absolute API base URL. REQUIRED when admin/erasure features are enabled:
-# it is the canonical value the NIP-98 `u` tag is verified against (never the
-# request Host header). Boot fails if unset while those features are on.
+# Public absolute API base URL — set this to YOUR real domain. It is the canonical
+# value the NIP-98 `u` tag is verified against (never the request Host header). In
+# production, boot fails closed if this is left as a placeholder (contains `example`
+# or `your-`) while Nostr identity (on by default), admin, or erasure is enabled —
+# so every real deployment must replace it.
 PUBLIC_API_URL=https://backend.example.org/api/v1
 ENVIRONMENT=development
-# Stable per-node identifier. Bound into signed admin/erasure actions so a proof
-# captured against one node cannot be replayed across a load-balanced fleet.
-INSTANCE_ID=
 
 # ── Database ──────────────────────────────────────────────────────────────
 DATABASE_URL=postgres://user:password@127.0.0.1:5432/smirk
@@ -31,6 +30,9 @@ REFRESH_TOKEN_PEPPER=
 IP_SALT=
 
 # ── Proof-of-work signup gate (ALTCHA v2) ─────────────────────────────────
+# FEATURE_POW is the master switch; POW_REQUIRED only applies when it is on. Boot
+# fails closed if POW_REQUIRED=true while FEATURE_POW=false (a silently-open gate).
+FEATURE_POW=false
 ALTCHA_HMAC_KEY=
 POW_REQUIRED=false
 ALTCHA_COST=100000
@@ -64,21 +66,13 @@ PAYMENT_CURRENCY=XMR
 PAYMENT_CONFIRMATIONS=1
 PAYMENT_EXPIRES_MINUTES=60
 
-# ── Bitcoin ───────────────────────────────────────────────────────────────
+# ── Bitcoin (Electrum/Fulcrum only; the backend runs no Core RPC node) ─────
 BTC_NETWORK=mainnet
-BTC_USE_LOCAL_NODE=false
-BTC_RPC_URL=http://127.0.0.1:8332
-BTC_RPC_USER=bitcoinrpc
-BTC_RPC_PASS=
 BTC_ELECTRUM_URL=
 BTC_ELECTRUM_FALLBACKS=
 
-# ── Litecoin ──────────────────────────────────────────────────────────────
+# ── Litecoin (Electrum/Fulcrum only; the backend runs no Core RPC node) ────
 LTC_NETWORK=mainnet
-LTC_USE_LOCAL_NODE=false
-LTC_RPC_URL=http://127.0.0.1:9332
-LTC_RPC_USER=litecoinrpc
-LTC_RPC_PASS=
 LTC_ELECTRUM_URL=
 LTC_ELECTRUM_FALLBACKS=
 
@@ -163,11 +157,27 @@ RELAY_ADMISSION_ALLOW_PUBLIC=false
 RELAY_MAX_EVENT_BYTES=65536
 RELAY_RETENTION_DAYS=30
 
+# ── Premium relay tier (optional; recurring, tiered relay-posting access) ──
+# Wallet use stays free; premium unlocks GENERAL Nostr posting to the relay
+# (wallet-functional events — DMs, tips, swap coordination — stay free). Requires
+# RELAY_ENABLED=true + RELAY_WRITE_POLICY=premium-post + the PAYMENT_* processor
+# block above. Off by default. See docs/design/premium-relay.md.
+PREMIUM_ENABLED=false
+# Price currency: a fiat code the processor converts, or a specific coin.
+PREMIUM_CURRENCY=USD
+# Comma-separated plans, each `id:days:amount` (a built-in tiered discount).
+PREMIUM_PLANS=quarter:90:5,halfyear:182:9,year:365:15
+
 # ── Admin surface (see docs; default posture is loopback/Tor) ──────────────
 # Admin auth is "Sign in with Smirk": only admin PUBLIC keys are stored here,
 # never a seed or private key. The allowlist is mutated CLI/loopback-only in v1.
 ADMIN_ENABLED=false
 ADMIN_BIND=127.0.0.1:8081
+# Public absolute URL of THIS node's admin surface. The per-node id that binds
+# signed admin actions (so a challenge signed for one node can't be replayed to
+# another across a fleet) is DERIVED from this value — give each node in a fleet a
+# distinct one. Must be an absolute URL when ADMIN_ENABLED=true.
+ADMIN_PUBLIC_URL=https://admin.example.org
 ADMIN_JWT_SECRET=
 # Integrity MAC secret protecting admin/setup trust anchors against DB tampering.
 # Losing this locks out admin — back it up (see docs/operations).
@@ -177,7 +187,11 @@ ADMIN_PENDING_KEY_TTL_DAYS=7
 
 # ── Public landing page (OFF by default; full + per-field tunable when on) ──
 PUBLIC_LANDING_ENABLED=false
-PUBLIC_EXPOSE_FEATURES=false
+# Optional custom landing title (leave unset for the default).
+#PUBLIC_LANDING_TITLE=
+PUBLIC_EXPOSE_VERSION=false
+PUBLIC_EXPOSE_CHAINS=false
+PUBLIC_EXPOSE_PRICE_FEED=false
 PUBLIC_EXPOSE_UPTIME=false
 PUBLIC_STATS_ENABLED=false
 PUBLIC_STATS_CACHE_HOURS=24