feat(relay): add corporate identity binding

[fsola-sq]

Why

Add the first relay-side corporate identity foundation so Buzz can bind an authenticated Nostr pubkey to a stable corporate user claim from a trusted JWT.

What

• Add configurable corporate identity JWT validation with JWKS, issuer, audience, uid, display, and optional npub claims
• Add community-scoped identity_bindings persistence with TOFU binding, conflict detection, source tracking, audit entries, and metrics
• Enforce corporate identity across WS auth, HTTP bridge, media, git, and huddle audio while preserving NIP-OA agent delegation through an already-bound owner
• Document PR1 operational limits: the JWT is an enrollment authority, bad bindings require manual repair, proxy headers must be overwritten, JWKS outages fail closed, and display claims may store PII
• Add focused unit tests for JWT/header/JWKS/delegation helpers and ignored Postgres tests for binding lifecycle semantics

Risk Assessment

Medium. This touches every relay auth transport, but is disabled by default behind BUZZ_REQUIRE_CORPORATE_IDENTITY and fails closed when enabled.

Follow-ups

• Client JWT forwarding / OIDC PKCE flow for desktop and helper clients
• Admin revocation, rotation, offboarding, and bad-binding repair workflows
• Optional startup JWKS reachability probe and a dedicated CI gate for ignored Postgres DB tests

Notes

In corporate identity mode, this PR intentionally treats a valid configured JWT as an enrollment authority: first use binds the JWT's stable corporate uid to the NIP-proven pubkey. A compromised corporate JWT can therefore create an incorrect binding until an operator repairs it; automated recovery is scoped to follow-up lifecycle work.

Update — 2026-07-24

• Project each active binding as a relay-signed NIP-85 user assertion over Nostr, without publishing the corporate uid.
• Have the desktop client fetch profile metadata and authoritative assertions through the existing Nostr query path.
• Trust assertions only when their signature matches the relay pubkey advertised in NIP-11 self.
• Prefer the authoritative display name and show a verification badge in messages, user profiles, and the signed-in user's sidebar profile.

Generated with Codex

---

Update Jul 24, 17:10 MDT: Fixed corporate admission for NIP-OA agents behind cf-doorman

• Prefer a cryptographically verified owner declaration over the owner JWT injected into an agent request.
• Require delegation to be enabled and the declared owner to have an active corporate identity binding; there is no blanket agent bypass.
• Applies consistently to WebSocket authentication and HTTP bridge event submission.