security: harden Lightning Wallet Connections (NWC)

- Add rate limiting to public LNURL endpoints (30 req/min per IP)
- Add audit logging for wallet lifecycle events (create, drain, delete, rotate)
- Add Unix socket support for Python ↔ Alby Hub communication
- Add LND macaroon permission documentation/warning
- Add pairing secret rotation API endpoint + CLI command
- Make Nostr relay configurable; auto-use Haven relay when enabled
- Strengthen domain validation (FQDN only, reject localhost/IP)
- Add structured audit log at /var/log/sovran-nwc-audit.log

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>

modules/nwc-wallets.nix

@@ -19,12 +19,16 @@ let
     NWC_LND_ADDRESS = "${lndRpcAddress}:${lndRpcPort}";
     NWC_LND_CERT_FILE = lndCertPath;
     NWC_LND_MACAROON_FILE = "/run/lnd/albyhub.macaroon";
+    NWC_RELAY = lib.mkIf config.sovran_systemsOS.features.haven
+      "wss://haven.${config.networking.domain}/nostr"
+      "wss://relay.getalby.com,wss://relay2.getalby.com";
   };
   wrappedNwcWallet = lib.hiPrio (pkgs.writeShellScriptBin "nwc-wallet" ''
     export NWC_ALBY_HUB_API_BASE='${pythonManagerEnvironment.NWC_ALBY_HUB_API_BASE}'
     export NWC_LND_ADDRESS='${pythonManagerEnvironment.NWC_LND_ADDRESS}'
     export NWC_LND_CERT_FILE='${pythonManagerEnvironment.NWC_LND_CERT_FILE}'
     export NWC_LND_MACAROON_FILE='${pythonManagerEnvironment.NWC_LND_MACAROON_FILE}'
+    export NWC_RELAY='${pythonManagerEnvironment.NWC_RELAY}'
     exec ${config.services.sovranHub.webPackage}/bin/nwc-wallet "$@"
   '');
 
@@ -108,7 +112,10 @@ lib.mkIf config.sovran_systemsOS.features."nwc-wallets" {
       WORK_DIR = "/var/lib/albyhub";
       DATABASE_URI = "/var/lib/albyhub/nwc.db";
       PORT = toString albyHubPort;
-      RELAY = "wss://relay.getalby.com,wss://relay2.getalby.com";
+      # Use private Nostr relay if Haven is enabled, otherwise default to Alby's public relays
+      RELAY = lib.mkIf config.sovran_systemsOS.features.haven
+        "wss://haven.${config.networking.domain}/nostr"
+        "wss://relay.getalby.com,wss://relay2.getalby.com";
       AUTO_LINK_ALBY_ACCOUNT = "false";
       SEND_EVENTS_TO_ALBY = "false";
       LOG_TO_FILE = "false";
@@ -170,4 +177,4 @@ lib.mkIf config.sovran_systemsOS.features."nwc-wallets" {
       needsDDNS = true;
     }
   ];
-}
+}