feat(pairing): default seed relay to the nostrclient endpoint + validate relays

Two robustness fixes for on-machine pairing (bitspire-#70), after a QR scan
silently corrupted a seed's relay (ws://→As://) and crash-looped a machine on
an unreachable relay:

- Default relays: when the operator omits `relays`, derive the seed's relay from
  THIS lnbits' own nostrclient proxy endpoint — `<ws(s)>://<host>/nostrclient/api/v1/relay`,
  built from `lnbits_baseurl` (default_relay_endpoint). Operators configure
  upstream relays once in the nostrclient extension (public_ws must be on) and
  every seed points at one stable, operator-independent URL. `relays` is now
  optional on PairMachineData + the /pair endpoint.
- Validate every relay (+ bunker_relay) is a `ws://`/`wss://` URL AND reject
  loopback hosts (localhost/127.0.0.1/::1/0.0.0.0) — a seed is redeemed by a
  REMOTE machine, so a localhost relay is exactly the unreachable case. Catches
  both the ws://→As:// corruption and the localhost /pair gotcha at mint time.

Consumer side (bitspire): parseSpireSeed rejects non-ws relays, and the wizard
gained a "test relay" reachability button before committing.

223 tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

models.py

@@ -94,10 +94,12 @@ class PairMachineData(BaseModel):
     the relay lnbits uses to reach the bunker differs from the one the spire
     must reach — e.g. an internal docker hostname (`ws://lnbits:5001/…`) vs a
     LAN/public URL (`ws://192.168.0.32:5001/…`), or any split-relay deploy.
-    `duration_hours` optionally time-bounds the spire's connect token
-    (None = non-expiring)."""
+    `relays` is optional: when omitted it defaults to this lnbits' nostrclient
+    proxy endpoint (derived from `lnbits_baseurl`), so the operator needn't
+    supply one (bitspire#70). `duration_hours` optionally time-bounds the
+    spire's connect token (None = non-expiring)."""
 
-    relays: list[str]
+    relays: list[str] | None = None
     bunker_relay: str | None = None
     duration_hours: int | None = None