feat: local Nostr relay with relay selection, sync, and integration tests

Local Nostr relay (NIP-01) on port 4869 with LittleFS 4MB storage.
All events published locally first, then synced to public relays via REQ-diff.
Relay selection via NIP-11 HTTP probing with NIP-77 scoring and auto-failover.

Components:
- wisp_relay: 16-file local relay (ws_server, storage_engine, sub_manager,
  broadcaster, relay_validator, router, handlers, rate_limiter, nip11,
  deletion, flash_monitor, relay_types)
- esp_littlefs: LittleFS VFS integration (git submodule)
- negentropy: for future NIP-77 binary sync (git submodule)

New source files:
- local_relay.c/h: thin wrapper for relay init/start/publish
- relay_selector.c/h: NIP-11 probe + scoring + auto-failover
- sync_manager.c/h: REQ-diff sync (primary 30min, fallback 6h)

Bug fixes:
- config.c: use-after-free (cJSON_Delete before seed_relays/sync parsing)
- local_relay: moved init to app_main for boot-time start (not gated on STA IP)

Flash layout: 4MB LittleFS partition at 0x500000 for relay_store

Test results (Board B, live hardware):
- Smoke: ping + HTTP 4869 + NIP-11: PASS
- NIP-11 info document: 10/11 PASS
- WS pub/sub (connect, REQ/EOSE, EVENT/OK, CLOSE, concurrent): 6/6 PASS
- Unit tests (relay_validator + relay_selector): 13/13 PASS

Hardware test make targets in physical-router-test-automation/:
- make relay-build, relay-flash-b, relay-test-smoke/nip11/pubsub/sync/full

1 files changed, 98 insertions, 0 deletions

diff --git a/components/wisp_relay/rate_limiter.c b/components/wisp_relay/rate_limiter.c
new file mode 100644
index 0000000..7734e03
--- /dev/null
+++ b/components/wisp_relay/rate_limiter.c
@@ -0,0 +1,98 @@
+#include "rate_limiter.h"
+#include "esp_timer.h"
+#include "esp_log.h"
+#include <string.h>
+
+static const char *TAG = "rate_limiter";
+
+void rate_limiter_init(rate_limiter_t *rl, const rate_config_t *config)
+{
+    memset(rl, 0, sizeof(rate_limiter_t));
+    rl->lock = xSemaphoreCreateMutex();
+    if (config) {
+        memcpy(&rl->config, config, sizeof(rate_config_t));
+    } else {
+        rl->config.events_per_minute = 30;
+        rl->config.reqs_per_minute = 60;
+    }
+}
+
+void rate_limiter_destroy(rate_limiter_t *rl)
+{
+    if (!rl) return;
+    if (rl->lock) {
+        vSemaphoreDelete(rl->lock);
+        rl->lock = NULL;
+    }
+}
+
+static rate_bucket_t* get_bucket(rate_limiter_t *rl, int fd)
+{
+    for (int i = 0; i < RATE_LIMITER_MAX_BUCKETS; i++) {
+        if (rl->buckets[i].active && rl->buckets[i].fd == fd) {
+            return &rl->buckets[i];
+        }
+    }
+    for (int i = 0; i < RATE_LIMITER_MAX_BUCKETS; i++) {
+        if (!rl->buckets[i].active) {
+            rl->buckets[i].fd = fd;
+            rl->buckets[i].active = true;
+            rl->buckets[i].event_count = 0;
+            rl->buckets[i].req_count = 0;
+            rl->buckets[i].window_start = esp_timer_get_time() / 1000000;
+            return &rl->buckets[i];
+        }
+    }
+    return NULL;
+}
+
+bool rate_limiter_check(rate_limiter_t *rl, int fd, rate_type_t type)
+{
+    xSemaphoreTake(rl->lock, portMAX_DELAY);
+
+    rate_bucket_t *bucket = get_bucket(rl, fd);
+    if (!bucket) {
+        xSemaphoreGive(rl->lock);
+        return false;
+    }
+
+    uint32_t now = esp_timer_get_time() / 1000000;
+
+    if (now - bucket->window_start >= 60) {
+        bucket->event_count = 0;
+        bucket->req_count = 0;
+        bucket->window_start = now;
+    }
+
+    bool allowed = true;
+    if (type == RATE_TYPE_EVENT) {
+        if (bucket->event_count >= rl->config.events_per_minute) {
+            ESP_LOGW(TAG, "Rate limited: fd=%d events=%d", fd, bucket->event_count);
+            allowed = false;
+        } else {
+            bucket->event_count++;
+        }
+    } else {
+        if (bucket->req_count >= rl->config.reqs_per_minute) {
+            ESP_LOGW(TAG, "Rate limited: fd=%d reqs=%d", fd, bucket->req_count);
+            allowed = false;
+        } else {
+            bucket->req_count++;
+        }
+    }
+
+    xSemaphoreGive(rl->lock);
+    return allowed;
+}
+
+void rate_limiter_reset(rate_limiter_t *rl, int fd)
+{
+    xSemaphoreTake(rl->lock, portMAX_DELAY);
+    for (int i = 0; i < RATE_LIMITER_MAX_BUCKETS; i++) {
+        if (rl->buckets[i].active && rl->buckets[i].fd == fd) {
+            rl->buckets[i].active = false;
+            break;
+        }
+    }
+    xSemaphoreGive(rl->lock);
+}