ops: move Nuri chat to chat.nuri.com and Space relays

[eminogrande]

Problem

The Nuri web app currently lives at support.nuri.com, while the support cockpit also occupies /inbox. UI and Nostr relay URLs are same-origin-coupled, and existing chat.nuri.com / relay.nuri.com records point to stale hosts.

Target topology

• https://chat.nuri.com — human-facing web app and Space directory
• wss://<slug>.relay.nuri.com — isolated Nostr relay host per Space
• https://support.nuri.com/inbox — existing support cockpit, unchanged
• https://support.nuri.com/ — redirect to https://chat.nuri.com

Acceptance criteria

1. Decouple web origin from selected relay origin and update CORS, NIP-98 URL binding, Connect return URLs, WebAuthn origin usage and tests without changing RP ID nuri.com or derivation nuri-expo-wallet-v1.
2. Configure Cloudflare DNS plus Caddy for chat.nuri.com, relay.nuri.com and wildcard Space relay hosts with valid TLS/WebSocket proxying; preserve /inbox and provide rollback backups.
3. Verify in a real browser that wallet login, Space directory, NIP-42 WSS, NIP-98 registration, create/join, #general, send/receive and support.nuri.com/inbox all work without console errors.

Not doing

• channel.nuri.com
• Changing the WebAuthn RP ID
• Moving the support cockpit

Branch reference

Integration follows feat/nuri-web-chat and the self-service Spaces changes.

Session

@session:default/20260724_150854_84a994