fix(relay): stop disclosing internal origins via NIP-98 and push

[VaibhavJain2609]

Summary

• Sanitize NIP-98 HTTP 401 bodies so unauthenticated callers no longer receive the relay's expected URL (which can be an internal bind address behind a reverse proxy). Detail stays in server logs via tracing::warn!; clients get AuthError::client_message().
• Omit NIP-11 push descriptors when the tenant host is private, loopback, or localhost (including localhost.), so push.origin cannot advertise internal topology on the unauthenticated root document.
• Pin both behaviors with unit tests in buzz-auth and buzz-relay.

Closes #4954

Related surfaces checked

• Git smart-HTTP already returned opaque "NIP-98 auth failed" (no change needed).
• buzz-media already collapses auth failures to "authentication failed".

Test plan

• cargo test -p buzz-auth --lib
• cargo test -p buzz-relay --lib push_descriptor
• cargo test -p buzz-relay --lib push_origin_host
• cargo test -p buzz-relay --lib verify_bridge_auth_rejects_nip98
• cargo test -p buzz-relay --lib moderation_read_query_bearing_nip98_event_rejected
• cargo clippy -p buzz-auth --lib -- -D warnings
• Confirm a mismatched NIP-98 POST /query returns {"error":"NIP-98: URL mismatch"} with no host/IP in the body
• Confirm NIP-11 with Host 10.x.x.x (push configured) omits push entirely

Made with Cursor