feat(dht): Phase 3 discovery glue + paid swarm serving

Phase 3 wiring (task #12):
- NostrSeedDiscovery: async ProviderDiscovery that queries relays for signed
  seed adverts and parses endpoint ids (swarm/iroh_provider.rs, seed_advert.rs).
- seed_and_advertise publish path; dep-free fetch/publish helpers reuse the
  node's Nostr identity (build_nostr_client/load_or_create_nostr_keys made
  pub(crate)).
- swarm::init builds the IrohProvider once into a OnceLock runtime; providers()
  returns it; announce_held_blob() is called from update.rs after a release
  component passes both hash gates.
- config swarm_enabled (ARCHIPELAGO_SWARM_ENABLED, default off); server.rs init.

Paid swarm serving (Phase 4 step F):
- swarm/paid.rs gates the iroh-blobs provider through streaming::gate,
  intercepting connect + GET (peer push hard-disabled). Free by default
  (content-download service disabled); denies unpaid peers when enabled;
  fails open on internal error so a payment fault never blocks distribution.
  Wired into IrohProvider::new.

All iroh code behind the iroh-swarm feature; the default build is inert.
Default build clean; --features iroh-swarm: 11/11 swarm tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core/archipelago/src/server.rs

@@ -150,6 +150,20 @@ impl Server {
             }
         }
 
+        // DHT swarm-assist (Phase 3): build the iroh provider once at startup so
+        // release downloads can fetch from peers (origin always wins) and seed
+        // what they hold. Inert unless built with `iroh-swarm` AND swarm_enabled.
+        if let Err(e) = crate::swarm::init(
+            &config.data_dir,
+            &config.nostr_relays,
+            config.nostr_tor_proxy.as_deref(),
+            config.swarm_enabled,
+        )
+        .await
+        {
+            tracing::warn!("Swarm init (non-fatal, falling back to origin-only): {}", e);
+        }
+
         // Revoke any previously published Nostr data (runs before publish so revocation is not overwritten)
         let identity_dir = config.data_dir.join("identity");
         let tor_proxy_revoke = config.nostr_tor_proxy.clone();