feat: implement NIP-42 WebSocket authentication

Add support for authenticating WebSocket clients using NIP-42 protocol,
enabling auth restrictions for normal Nostr clients.

Storage layer (internal/storage/auth.go):
- CreateAuthChallenge() - Generate random 32-byte challenge with 10min TTL
- ValidateAndConsumeChallenge() - Verify challenge validity and mark as used
- CleanupExpiredChallenges() - Remove old challenges from database
- Uses existing auth_challenges table

WebSocket handler (internal/handler/websocket/handler.go):
- Track authenticatedPubkey per connection
- Track authChallenge per connection
- requireAuth() - Check if operation requires authentication
- handleAuth() - Process AUTH responses (kind 22242 events)
- sendAuthChallenge() - Send AUTH challenge to client
- Enforce auth on EVENT (writes) and REQ (reads) messages
- Support separate read/write allowlists

Main (cmd/relay/main.go):
- Wire auth config from YAML to WebSocket handler
- Pass read/write enabled flags and allowed npub lists

NIP-42 Flow:
1. Client sends EVENT/REQ without auth
2. If auth required, relay sends: ["AUTH", "<challenge>"]
3. Client signs kind 22242 event with challenge tag
4. Client sends: ["AUTH", <signed-event>]
5. Relay validates signature, challenge, and allowlist
6. Connection marked as authenticated
7. Client can now EVENT/REQ

Example config to restrict writes to your npub:
```yaml
auth:
  write:
    enabled: true
    allowed_npubs:
      - npub1your-npub-here...
```

WebSocket clients (Damus, Amethyst, etc.) can now authenticate!

1 files changed, 88 insertions, 0 deletions

diff --git a/internal/storage/auth.go b/internal/storage/auth.go
new file mode 100644
index 0000000..6eefa41
--- /dev/null
+++ b/internal/storage/auth.go
@@ -0,0 +1,88 @@
+package storage
+
+import (
+        "context"
+        "crypto/rand"
+        "encoding/hex"
+        "fmt"
+        "time"
+)
+
+const (
+        ChallengeLength = 32 // bytes
+        ChallengeTTL    = 10 * time.Minute
+)
+
+func generateChallenge() (string, error) {
+        bytes := make([]byte, ChallengeLength)
+        if _, err := rand.Read(bytes); err != nil {
+                return "", fmt.Errorf("failed to generate challenge: %w", err)
+        }
+        return hex.EncodeToString(bytes), nil
+}
+
+func (s *Storage) CreateAuthChallenge(ctx context.Context) (string, error) {
+        challenge, err := generateChallenge()
+        if err != nil {
+                return "", err
+        }
+
+        now := time.Now().Unix()
+        expiresAt := time.Now().Add(ChallengeTTL).Unix()
+
+        _, err = s.db.ExecContext(ctx,
+                "INSERT INTO auth_challenges (challenge, created_at, expires_at, used) VALUES (?, ?, ?, 0)",
+                challenge, now, expiresAt,
+        )
+        if err != nil {
+                return "", fmt.Errorf("failed to store challenge: %w", err)
+        }
+
+        return challenge, nil
+}
+
+func (s *Storage) ValidateAndConsumeChallenge(ctx context.Context, challenge string) error {
+        tx, err := s.db.BeginTx(ctx, nil)
+        if err != nil {
+                return fmt.Errorf("failed to begin transaction: %w", err)
+        }
+        defer tx.Rollback()
+
+        var expiresAt int64
+        var used int
+        err = tx.QueryRowContext(ctx,
+                "SELECT expires_at, used FROM auth_challenges WHERE challenge = ?",
+                challenge,
+        ).Scan(&expiresAt, &used)
+
+        if err != nil {
+                return fmt.Errorf("challenge not found or invalid")
+        }
+
+        if used != 0 {
+                return fmt.Errorf("challenge already used")
+        }
+
+        if time.Now().Unix() > expiresAt {
+                return fmt.Errorf("challenge expired")
+        }
+
+        _, err = tx.ExecContext(ctx,
+                "UPDATE auth_challenges SET used = 1 WHERE challenge = ?",
+                challenge,
+        )
+        if err != nil {
+                return fmt.Errorf("failed to mark challenge as used: %w", err)
+        }
+
+        return tx.Commit()
+}
+
+func (s *Storage) CleanupExpiredChallenges(ctx context.Context) error {
+        now := time.Now().Unix()
+        _, err := s.db.ExecContext(ctx,
+                "DELETE FROM auth_challenges WHERE expires_at < ?",
+                now,
+        )
+        return err
+}