feat(relay): add Nuri self-service Spaces

[eminogrande]

Problem

Buzz already has host-isolated communities and create_community_with_owner, but the only creation surface is deployment-operator-only. Nuri users cannot create or discover Spaces from the browser, and POST /api/nuri/register currently has no per-Space public/private join policy.

User flow

1. A user unlocks the existing Nuri Connect/Passkey identity on chat.nuri.com.
2. Create Space validates a unique slug, creates <slug>.relay.nuri.com, makes the NIP-98 signer the owner, and atomically creates the initial General category plus #general channel.
3. Join Space admits an authenticated user directly when the Space is public, or requires a valid invite when private.
4. The user may own/join multiple isolated Spaces.

Acceptance criteria

1. Add a NIP-98 + Connect-bound self-service API that creates a normalized *.relay.nuri.com community with the signer as sole owner, enforces owner quotas and slug collision/rate-limit rules, and bootstraps #general atomically.
2. Persist Space name, slug, visibility (public/private) and directory state; expose a bounded public directory plus an authenticated membership list without leaking private Spaces.
3. Public join and private invite join add only the authenticated Connect/Nostr identity to the selected community; tests prove cross-community isolation, replay rejection, host-suffix enforcement and concurrent create idempotency.

Not doing

• Arbitrary custom domains
• Anonymous posting
• Nested Spaces
• Billing or paid plans

Branch reference

Integration follows feat/nuri-web-chat after issue #3 lands.

Session

@session:default/20260724_150854_84a994