Deploy: relay and peer-discovery sovereignty: demonstrate the dependency can be removed

[oesteban]

Two steps in a peer-to-peer connection lean on outside servers by default. Machines behind home or campus routers sometimes cannot connect directly and have to be relayed; and before any connection, a node has to look up where its peers currently are (peer discovery). By default both the relay fallback and the peer-discovery lookup run on servers operated by the transport's upstream project, which are rate-limited and documented by that project as intended for development and testing. This task does not stand up a production relay or discovery service; operating such a service is not part of the plan. It demonstrates, once and reproducibly, that both dependencies can be removed, and exposes the configuration that makes removal a setting rather than a rebuild.

Outcomes

• Relay and peer discovery exposed as first-class configuration: a services.dspeer-relay NixOS module packaging the open-source relay, and peer discovery configurable to an operator-run service or to the public distributed hash table, with documented direct-only behaviour when no relay is reachable
• A reproducible demonstration that brings up an operator-run relay and peer discovery, switches the upstream defaults off, and completes a federation end to end with no third-party service in the path; reproducible by a reader from the documented steps, and operating nothing on an ongoing basis
• A relay-and-discovery sovereignty page: what the default configuration uses out of the box, that every relay and discovery endpoint is configurable, how to move fully off the upstream defaults, and what changes if you do