relay: NIP-29 groups, moderators and ownership transfer (#9)

* relay: roles, ownership transfer and relay-signed group records

One permission table (roles.ts) says what an owner and a moderator may do.
Members carry a role; the owner can hand the relay to a member and stays on
as a moderator. The identity signs NIP-29 put-user and remove-user records
and the group's metadata, admins, members and roles, on the same strictly
increasing clock as the roster. Invite codes may be chosen by the caller.

* relay: NIP-29, one group per relay, moderated by role

The relay's name is the group id; events tagged for any other group are
refused. Join and leave requests, put-user, remove-user, edit-metadata,
delete-event and create-invite are applied through the permission table
instead of the write policy, then stored and broadcast. Every membership or
rule change republishes the relay-signed group state. The NIP-86 methods use
the same table: a moderator gets people, bans, deletions, invites and
reports, and transferowner hands the relay over.

* console: roles, ownership transfer and a moderator's view

The owner sets a member's role from the People tab and hands the relay over
from the Identity tab with a typed confirmation. A signed-in moderator gets
the People tab and the recent-events browser, nothing else.

* docs: groups, moderators and ownership transfer

commit

388111fc1df3a70244cb629c29a109b6af4fbf75

parent

b4c4b036b3c0f660013aa075de6e17b8f8c7fb83

author

FelineStateMachine <dami.etoile@gmail.com>