security: harden Lightning Wallet Connections (NWC)

- Add rate limiting to public LNURL endpoints (30 req/min per IP)
- Add audit logging for wallet lifecycle events (create, drain, delete, rotate)
- Add Unix socket support for Python ↔ Alby Hub communication
- Add LND macaroon permission documentation/warning
- Add pairing secret rotation API endpoint + CLI command
- Make Nostr relay configurable; auto-use Haven relay when enabled
- Strengthen domain validation (FQDN only, reject localhost/IP)
- Add structured audit log at /var/log/sovran-nwc-audit.log

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>

app/sovran_systemsos_web/nwc_wallet_cli.py

@@ -36,6 +36,9 @@ def main(argv: list[str] | None = None) -> int:
     addr_show = addr_sub.add_parser("show")
     addr_show.add_argument("alias")
 
+    rotate = sub.add_parser("rotate")
+    rotate.add_argument("wallet")
+
     sub.add_parser("health")
 
     args = parser.parse_args(argv)
@@ -80,6 +83,19 @@ def main(argv: list[str] | None = None) -> int:
         _print(result)
         return 0
 
+    if args.cmd == "rotate":
+        try:
+            result = manager.rotate_wallet_secret(args.wallet)
+        except _mgr_mod.AlbyHubError as exc:
+            print(f"Error: {exc.code} - {exc}", file=sys.stderr)
+            return 1
+        _print({
+            "wallet_id": result.get("wallet_id", ""),
+            "pairing_uri": result.get("pairing_uri", ""),
+            "message": result.get("message", "New NWC connection secret generated. Save it now — it will not be shown again."),
+        })
+        return 0
+
     if args.cmd == "create":
         alias = args.alias.strip().lower()
         if not _nwc_validate_alias(alias):