feat(dht): Phase 3 discovery glue + paid swarm serving

Phase 3 wiring (task #12):
- NostrSeedDiscovery: async ProviderDiscovery that queries relays for signed
  seed adverts and parses endpoint ids (swarm/iroh_provider.rs, seed_advert.rs).
- seed_and_advertise publish path; dep-free fetch/publish helpers reuse the
  node's Nostr identity (build_nostr_client/load_or_create_nostr_keys made
  pub(crate)).
- swarm::init builds the IrohProvider once into a OnceLock runtime; providers()
  returns it; announce_held_blob() is called from update.rs after a release
  component passes both hash gates.
- config swarm_enabled (ARCHIPELAGO_SWARM_ENABLED, default off); server.rs init.

Paid swarm serving (Phase 4 step F):
- swarm/paid.rs gates the iroh-blobs provider through streaming::gate,
  intercepting connect + GET (peer push hard-disabled). Free by default
  (content-download service disabled); denies unpaid peers when enabled;
  fails open on internal error so a payment fault never blocks distribution.
  Wired into IrohProvider::new.

All iroh code behind the iroh-swarm feature; the default build is inert.
Default build clean; --features iroh-swarm: 11/11 swarm tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core/archipelago/src/update.rs

@@ -847,6 +847,10 @@ pub async fn download_update(data_dir: &Path) -> Result<DownloadProgress> {
                     download_component_resumable(&client, component, &dest, downloaded).await?;
                 }
             }
+            // This is a PUBLIC release blob and it just passed both the BLAKE3 and
+            // SHA-256 gates — announce that we can now seed it to peers. Best-effort
+            // and inert unless the iroh swarm is active; never blocks the install.
+            crate::swarm::announce_held_blob(&digest.hex, &dest).await;
         } else {
             download_component_resumable(&client, component, &dest, downloaded).await?;
         }