docs(examples): operator cookbook — six deployment recipes + premium-relay spec

Add ready-to-run .env + README recipes (personal, public-free, friends,
paid-access, paid-relay, community) and the premium-relay design overview,
with audit fixes to the config template and spec:

- Drop the inert INSTANCE_ID knob (config never read it) and document the real
  per-node id, which is derived from ADMIN_PUBLIC_URL.
- Warn that a placeholder PUBLIC_API_URL is rejected at boot in production
  (Nostr identity is on by default); soften the recipe "boots today" status.
- Remove dead template vars: BTC/LTC Core-RPC settings and the non-existent
  PUBLIC_EXPOSE_FEATURES (replaced with the real per-field landing switches).
- Mark ALTCHA_HMAC_KEY conditional in PoW-off recipes; blank placeholder
  payment creds so a recipe doesn't ship a key that fails validation.
- Fix premium-relay spec drift: the migration creates no premium_until index,
  disabled endpoints return 400/200 (not 404), and neutralize operator voice.

examples/community/.env.example

@@ -0,0 +1,54 @@
+# ── Recipe: community ────────────────────────────────────────────────────────
+# A gated space for a named project / community: invite-only registration plus a
+# relay that ONLY your registered members may publish to (author-allowlist). A
+# members-only Nostr space with its own DM inbox.
+#
+# ⚠️  Running a relay hosts user content — see ../LEGAL_AND_OPS.md.
+#
+# Start from ../../.env.example and apply the lines below. openssl rand -hex 32
+# for each secret.
+# ─────────────────────────────────────────────────────────────────────────────
+
+SERVER_HOST=127.0.0.1
+SERVER_PORT=8080
+# REQUIRED: replace with YOUR real https domain. The your-domain.example placeholder
+# is rejected at boot in production (Nostr identity is on by default).
+PUBLIC_API_URL=https://api.your-domain.example/api/v1
+ENVIRONMENT=production
+
+DATABASE_URL=postgresql:///smirk?host=/var/run/postgresql
+
+JWT_SECRET=
+SEED_FINGERPRINT_PEPPER=
+REFRESH_TOKEN_PEPPER=
+IP_SALT=
+# ALTCHA_HMAC_KEY — only needed if you set FEATURE_POW=true (this recipe leaves PoW off).
+ALTCHA_HMAC_KEY=
+ADMIN_KEY_INTEGRITY_SECRET=
+
+# Invite-only membership (mint codes with `smirk-admin mint-invite`).
+POW_REQUIRED=false
+REGISTRATION_REQUIRE_INVITE=true
+REGISTRATION_REQUIRE_PAYMENT=false
+
+WALLET_RESTORE_POLICY=unlimited
+FEATURE_PRICES=true
+FEATURE_TIPS=false
+
+# Relay on, members-only: only registered members may publish anything.
+RELAY_ENABLED=true
+RELAY_MODE=bundled
+RELAY_URL=wss://relay.your-domain.example
+RELAY_WRITE_POLICY=author-allowlist
+RELAY_INBOUND_POW_BITS=0
+RELAY_ADMISSION_BIND=127.0.0.1:8090
+
+# Chain endpoints — see ../../.env.example.
+XMR_LWS_URL=
+XMR_LWS_ADMIN_URL=
+XMR_LWS_ADMIN_KEY=
+XMR_DAEMON_URL=
+WOW_LWS_URL=
+WOW_LWS_ADMIN_URL=
+WOW_LWS_ADMIN_KEY=
+WOW_DAEMON_URL=