feat: add axon CLI for pub/sub; fix relay hijack context bug

- cmd/axon: new CLI module with keygen, pub, and req subcommands
  - keygen: generate Ed25519 keypair, print hex seed and pubkey
  - pub: sign and publish an event; accepts --kind, --content, --tag
  - req: query/stream events as JSON lines; accepts --kind, --author,
    --tag, --since, --until, --limit, --stream
  - key loaded from --key flag or AXON_KEY env var

- relay/websocket: add Dial() for client-side WebSocket handshake
  (ws:// and wss://, RFC 6455 masking via client:true)

- relay/server: fix broken-pipe on auth by switching hijacked conn
  goroutine from r.Context() to context.Background(); r.Context() is
  cancelled by net/http immediately after Hijack is called

1 files changed, 4 insertions, 1 deletions

diff --git a/relay/server.go b/relay/server.go
index 085929c..d4a1edd 100644
--- a/relay/server.go
+++ b/relay/server.go
@@ -98,7 +98,10 @@ func (s *Server) handleWS(w http.ResponseWriter, r *http.Request) {
         s.mu.Add(1)
         go func() {
                 defer s.mu.Done()
-                ctx := r.Context()
+                // r.Context() is cancelled by the HTTP server when Hijack is called,
+                // so we use a fresh context. The connection manages its own lifecycle
+                // via the ping loop and WebSocket close frames.
+                ctx := context.Background()
                 h.serve(ctx)
                 if err := c.CloseConn(); err != nil {
                         // Ignore close errors — connection may already be gone.