fix(pairing): default relay to the transport's nostrrelay, not nostrclient proxy

The nostrclient endpoint is a subscription MULTIPLEXER, not a full relay: its
router forwards a client's EVENT upstream but never returns an OK ack (see
nostrclient/router.py). A transport client that awaits OK on publish therefore
times out ("publish timed out"), so kind-21000 RPCs never complete — verified
on the Sintra: connect succeeded but list_wallets hung, and switching to the
nostrrelay endpoint made the whole flow work (wallet, balance, availability).

default_relay_endpoint now derives from settings.nostr_transport_relays — the
relay the transport actually listens on: use it as-is when already
machine-reachable, or re-home its path on lnbits_baseurl when it's a co-located
loopback relay (the bundled nostrrelay). Validation/localhost-reject and the
pair-dialog pre-fill/hint carry over; wording updated to "transport relay".

227 tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

models.py

@@ -94,8 +94,8 @@ class PairMachineData(BaseModel):
     the relay lnbits uses to reach the bunker differs from the one the spire
     must reach — e.g. an internal docker hostname (`ws://lnbits:5001/…`) vs a
     LAN/public URL (`ws://192.168.0.32:5001/…`), or any split-relay deploy.
-    `relays` is optional: when omitted it defaults to this lnbits' nostrclient
-    proxy endpoint (derived from `lnbits_baseurl`), so the operator needn't
+    `relays` is optional: when omitted it defaults to the relay the transport
+    listens on (derived from the transport config), so the operator needn't
     supply one (bitspire#70). `duration_hours` optionally time-bounds the
     spire's connect token (None = non-expiring)."""