feat: ISO networking stack — relay + nvpn v0.3.7 + WireGuard

Add nostr-rs-relay as native system service (port 7777) for VPN
signaling. Every node runs its own private relay from first boot.
Update nvpn binary from v0.3.4 to v0.3.7 (fixes mesh event
processing). Add WireGuard helper and address service for peer VPN.
First-boot script configures relay, nvpn identity, relay URLs
(direct + Tor onion), and syncs daemon config.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

image-recipe/configs/nostr-relay.service

@@ -0,0 +1,24 @@
+[Unit]
+Description=Archipelago Private Nostr Relay
+After=network-online.target
+Wants=network-online.target
+Before=nostr-vpn.service
+
+[Service]
+Type=simple
+User=archipelago
+ExecStartPre=/bin/bash -c 'mkdir -p /var/lib/archipelago/nostr-relay'
+ExecStart=/usr/local/bin/nostr-rs-relay --config /var/lib/archipelago/nostr-relay/config.toml
+Restart=always
+RestartSec=3
+TimeoutStopSec=10
+
+# Resource limits — relay is lightweight (in-memory mode)
+MemoryMax=512M
+LimitNOFILE=4096
+
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target