Folds the review's CS-3 finding into the boot-DM fix:
- notifyAdminsOfNewConnection wraps the publish loop in try/finally so a throw
mid-loop can't leak the throwaway pool's reconnect loops + sockets for the
process lifetime.
- The constructor's fire-and-forget call now .catch()es (both the notify and the
config() it chains off), so a boot-DM failure can't surface as an unhandled
rejection — process-terminating under Node defaults.
- dmUser guards its whole body: nip19.decode/nip04.encrypt ran *before* the old
publish-only try, so a malformed admin npub (passes startsWith, fails the
bech32 checksum) threw past the caller. Now best-effort, never throws.
Refs: #48, review CS-3
The boot-time admin notification (notifyAdminsOfNewConnection) spun up a
throwaway RelayPool to two external public relays, slept a fixed 2500ms, then
published. Those relays are often slow to connect, so on the aio-demo deploy the
publish failed on boot ("relay not connected: wss://blastr.f7z.xyz; …") — caught
and logged, non-fatal, but noisy every boot.
Poll pool.connectedCount() > 0 up to an 8s cap instead: send as soon as a relay
is up, and still best-effort — fall through and let dmUser log the failure if
none connect in time.
Refs: #48, #45
