feat(relay): add buzz-admin member management CLI with NIP-43 roster publish

[wpfleger96]

Summary

Relay membership management previously required raw SQL via docker compose exec postgres psql. This PR adds a first-class operator CLI via buzz-admin — the existing dedicated operator binary — and ships it in the relay Docker image.

Changes

crates/buzz-admin/src/main.rs

Upgrades the stub add-member / list-members implementations and adds remove-member:

• Accepts bech32 npub or 64-char hex via nostr::PublicKey::parse
• Rejects role owner (use RELAY_OWNER_PUBKEY config to set the relay owner)
• After add/remove: publishes kind:13534 membership roster via Redis so live clients see the updated list immediately
• custom_created_at = max(now, newest_existing_13534 + 1s) defeats same-second domination for serial invocations
• Exit codes: 0=success, 1=validation, 2=NotFound, 3=IsOwner, 4=RoleMismatch, 5=DB/Redis error

Dockerfile

Builds and ships buzz-admin alongside buzz-relay so docker compose exec relay buzz-admin works out of the box.

deploy/compose/run.sh

Adds add-member, remove-member, and list-members shortcuts that delegate to buzz-admin inside the container.

NOSTR.md

Documents the CLI, NIP-43 admin events (kind:9030-9032), kind:13534 roster subscription, and known limitations (delta-omission, TOCTOU concurrency scope).

ARCHITECTURE.md

Adds remove-member to the buzz-admin subcommand table; notes that the binary is now shipped in the relay image.

Usage

# Docker Compose (recommended)
./run.sh add-member npub1abc...
./run.sh add-member npub1abc... --role admin
./run.sh remove-member npub1abc...
./run.sh list-members

# Direct container exec
docker compose exec relay buzz-admin add-member --pubkey npub1abc...
docker compose exec relay buzz-admin remove-member --pubkey <hex>
docker compose exec relay buzz-admin list-members

Known Limitations

• CLI does not emit kind:8000/8001 deltas — publish_nip43_delta is in-process-only (no Redis hop); the kind:13534 list snapshot is the authoritative roster
• The timestamp bump serializes sequential invocations but not concurrent ones — run.sh serialization guards against parallel adds