fix(nip46): refuse to dial relays through inherited *_PROXY env vars

[oth-body]

Summary

When users try to sign in via Amber, hoot's NIP-46 flow calls nostr.RelayConnect(ctx, relayURL) to subscribe for the bunker's response. That function delegates to net/http, which honors the HTTPS_PROXY / HTTP_PROXY / ALL_PROXY / SOCKS_PROXY env vars inherited from the parent shell. If any of those point at a proxy port that isn't running (typically 127.0.0.1:9050 on machines without Tor), the dial fails with connect: connection refused, and the TUI shows the user a "failed to connect to port 9050" error with no signal about the actual cause.

This is the dominant "Amber sign-in failed" complaint in practice. It happens when:

• the user ran hoot inside torsocks (TUI tools don't need it)
• the user's shell exported HTTPS_PROXY for curl / monerod / nix and they don't realise hoot inherits it
• the user's desktop launcher (e.g. a Tailscale-aware wrapper) sets HTTPS_PROXY for outgoing HTTPS and forgot to scope it

Fix

nip46.WaitForConnection now:

1. Refuses to dial at all when any *_PROXY env var is set, returning a user-actionable error that names the offending env var and the proxy host:port. Matches what every other Nostr TUI does (nak, lume, etc.) — none of them proxy wss:// by default.
2. Validates the relay URL up front (blank / non-wss URL → clear error instead of a confusing websocket error later).
3. Wraps the relay dial error with the relay URL so non-proxy failures are easier to diagnose.

Tests

nip46/nip46_test.go pins:

• proxy env var detection order matches httpproxy (HTTPS_PROXY > HTTP_PROXY > ALL_PROXY > socks fallbacks)
• malformed or scheme-less URLs are rejected
• empty values fall through (matches stdlib)
• WaitForConnection surfaces the env var name and port on the user-visible error path (regression guard)
• blank and non-wss relay URLs are rejected up front
• Session.Close is idempotent when no dial was attempted

11 tests, all pass.

Tested manually

$ go test ./nip46/ -v
=== RUN   TestDetectProxyNoEnv                  ... PASS
=== RUN   TestDetectProxyTor9050                ... PASS
=== RUN   TestDetectProxyHTTPSBeatsHTTP         ... PASS
=== RUN   TestDetectProxyAllProxyFallback       ... PASS
=== RUN   TestDetectProxySkipsMalformed         ... PASS
=== RUN   TestDetectProxyEmptyValue             ... PASS
=== RUN   TestDetectProxySchemeRequiredRe       ... PASS
=== RUN   TestWaitForConnectionRefusesProxyEnv  ... PASS
=== RUN   TestWaitForConnectionRejectsBlankURL  ... PASS
=== RUN   TestWaitForConnectionRejectsNonWSSURL ... PASS (4 sub-tests)
=== RUN   TestSessionCloseIsIdempotent          ... PASS
ok      hoot/nip46  0.012s

Followups

For the root-cause fix (so users who want Tor can route through it explicitly without *_PROXY), I'd like to file a separate PR against github.com/nbd-wtf/go-nostr adding a WithProxyURL RelayOption. The default httpproxy-driven behaviour is the wrong default for a TUI app — every other Nostr client in the wild ships without it.

[oth-body]

---

Rebased onto master (was 1e11022, now 97585df) after PRs #66–#72 restructured NIP-46 (single RelayURL → []RelayURLs; WaitForConnection → ConnectRelays + CheckConnection). Diff stats: +89 in nip46.go, +231 in nip46_test.go. All 11 new tests + 4 existing master tests pass. go vet ./... and go build ./... clean.