feat(relay): add relay-verified identity binding

[fsola-sq]

Why

Add a provider-neutral relay-side identity foundation that binds a verified JWT principal to a NIP-proven Nostr key.

What

• Add configurable JWT validation for JWKS URI, issuer, audience, header, subject, display-name, and optional pubkey claims.
• Persist issuer-qualified (community, issuer, uid) bindings with fail-closed conflict handling and durable revocation tombstones.
• Make direct-JWT versus delegated-owner precedence explicit and configurable instead of inferring it from the presence of a NIP-OA owner declaration.
• Enforce the verified identity consistently across WebSocket, HTTP bridge, media, Git, and audio transports.
• Publish relay-signed NIP-85 assertions without disclosing the upstream identity-provider issuer, and present them as relay-verified identity in the desktop UI.
• Run the ignored PostgreSQL identity-binding and relay identity lifecycle tests in hosted CI.

Risk Assessment

Medium. This touches every relay authentication transport, but the feature is disabled by default behind BUZZ_REQUIRE_CORPORATE_IDENTITY and fails closed when enabled.

Follow-ups

• Add client-held OIDC with system-browser PKCE.
• Add operator revocation, rotation, offboarding, and bad-binding repair workflows.
• Add bounded authorization sessions, lease expiry and renewal, and live connection and delegated-agent eviction.
• Add an optional startup JWKS reachability probe.

Notes

When enabled, the configured JWT acts as an enrollment authority: first use binds the verified issuer-qualified principal to the NIP-proven pubkey. A compromised valid JWT can therefore create an incorrect binding until an operator repairs it; automated recovery remains follow-up lifecycle work.

Trusted deployments must overwrite the configured identity header at the relay boundary. JWKS failures fail closed, and configured display-name claims may result in stored personal information.

Update — 2026-07-28

• Qualified persisted principals by issuer.
• Removed upstream issuer disclosure from public assertions.
• Made direct-versus-delegated authentication precedence provider-neutral and configurable.
• Replaced deployment-specific terminology and fixtures with generic relay/proxy/identity-provider terminology.
• Renamed user-facing verification language to “Relay-verified identity.”
• Preserved revoked-binding tombstones and added hosted lifecycle coverage.

Generated with Codex