feat: add self-service Nuri Spaces

[eminogrande]

Summary

• add NIP-98 and replay-protected hub APIs to list, create, and join Nuri Spaces
• atomically make the authenticated signer the Space owner and bootstrap #general
• support public discovery/direct join and private invite-only membership
• add a Discord-style Space directory, create/join forms, Space rail, and per-Space relay switching
• expose the server-confirmed bootstrap Channel so a new Space can immediately enter #general without server-side user impersonation

Security and tenancy

• Space endpoints are available only on the canonical configured hub authority
• GET and POST use their exact NIP-98 methods and URLs; POST requires payload binding
• the request body never supplies an owner pubkey
• create/join require an existing hub membership
• public join rechecks visibility inside the DB insert
• private Spaces stay absent from outsider directory results and continue through tenant-bound invite claim
• exact Space host suffix: <slug>.relay.nuri.com

Verification

• cargo fmt --all -- --check
• cargo clippy -p buzz-db -p buzz-relay --all-targets -- -D warnings
• Relay API unit tests: 2 passed
• fresh PostgreSQL with migrations 0001-0025: successful
• Space PostgreSQL integration tests: 8 passed, including owner quota, idempotency, private filtering, #general, and concurrent slug collision
• pnpm run check
• Web typecheck
• Web unit tests: 13 passed
• Web production build
• Playwright smoke: 7 passed

Closes #4
Advances #5
Depends on #6 for canonical DNS/TLS deployment.