fix(relay): accept imeta from trusted public origin

[reinhold-ph]

Summary

Stock Buzz Desktop 0.5.14 uploads message images through the trusted public relay origin and receives absolute descriptors such as:

https://buzz.peakhunter.com:8443/media/<sha256>.<ext>

Event ingestion previously reconstructed the media base from the canonical tenant host (buzz.peakhunter.com:3000), so a signed kind-9 event containing the upload-returned secure URL was rejected.

This patch:

• passes the already source-bound RelayOrigin from HTTP and WebSocket entry points into shared ingestion;
• validates ordinary, link-preview, and product-feedback imeta against relay_origin.http_url("/media");
• preserves canonical Host-based tenant selection and tenant-scoped blob verification;
• rejects mismatched absolute origins, including the canonical :3000 authority when the event arrives through :8443;
• removes the superseded canonical media-base helper.

Stack / review boundary

This is a deliberately small stacked PR:

• Base: fix/relay-media-request-origin-auth at c3a5445e07b6105ea32d1c7bd48ee9e731294f93
• Head: fix/relay-imeta-public-origin at 645716ff9becc3b0f1acbfb2d74dbc279147c4b0
• Range: 4 commits, 5 files, 74 insertions, 35 deletions

The Peakhunter default branch is behind and diverged from this deployed relay baseline. A direct PR to main would mix this five-file product fix with a 969-file baseline synchronization. Integration of the baseline branch into main is intentionally a separate approval and PR-topology task.

Verification

• Focused source-origin tests: 2 passed, 0 failed
• cargo fmt --all -- --check: passed
• cargo test -p buzz-relay --tests --no-run: passed
• Serial relay library suite at head: 871 passed, 9 failed, 40 ignored
  • The same nine database/infrastructure failures reproduce at the exact parent baseline.
• Telemetry test: passed 3/3 in isolation and in the serial suite; its parallel-only failure was isolated to process-global tracing test order.
• Clippy with -D warnings: the exact same two buzz-media diagnostics reproduce at parent and head; no head-only diagnostic remains.
• Independent security/logic review found the source-bound HTTP/WS/product-feedback wiring correct; its sole final blocker—the obsolete helper warning—was removed at the final head.
• git diff --check passed.

Deployment and acceptance

Built from exact detached clean source 645716ff9… as Linux/amd64:

SHA-256: 229054edc3253f053101258a3b4e4dd7aa8dde08980d40b42d09679056c29ef1
ELF64 x86-64 PIE, stripped

Production verification:

• live binary hash matches;
• relay and HAProxy active;
• direct and secure health return ok;
• secure NIP-11 returns valid JSON;
• stock Buzz Desktop 0.5.14 successfully sent and rendered a fresh image message through :8443.

Non-goals

• No Desktop application change.
• No arbitrary-origin or same-host/unknown-port trust.
• No rewrite of historical signed events.
• Historical http://...:3000/media/... rendering compatibility remains separate.

[reinhold-ph]

Current deployment provenance

• Durable source branch: production/relay-dual-secure at 645716ff9becc3b0f1acbfb2d74dbc279147c4b0.
• Annotated provenance tag: peakhunter/provenance/relay-645716ff (not a product release).
• Live/staged binary SHA-256: 229054edc3253f053101258a3b4e4dd7aa8dde08980d40b42d09679056c29ef1.
• Matching tracked configuration snapshot: Peakhunter/reinhold-server@3cbf21cfa9d9d54cb1232efd906182ea2655d703.
• The binary/source association is recorded from the matching staged artifact; it was not independently reproduced from an embedded SHA or surviving build.

The branch and tag were created by adding refs to existing Git objects. No running bytes were rebuilt, redeployed, or restarted.

This PR remains open because its exact head behavior is deployed. A 2026-08-18 review found one signed :8443 media URL, in a deliberate test event. Mobile configured for canonical :3000 does not authorize that cross-authority URL, so leaving :8443 live is not itself a Mobile fix; narrowly scoped client-side legacy-authority mapping is the durable compatibility path. The :8443 frontend remains unchanged as bounded compatibility while mapping or retirement is separately reviewed.