Phase 3 of the firehose rework (after #7, #9). Adds the relay-lists hose (kind 10002), after which every kind is hose-owned and the legacy raw-upsert fallback is empty.

Background

relay_lists stores the raw kind-10002 event ({ pubkey, content, created_at, id, kind, sig, tags:[["r",url],…] }); diddoc reads the r tags to build the service/Relay entries. The old relayhose.js just $set-upserted the raw event — no signature check, no discovery.

Scope

• src/hoses/relays.js: shared relay-directory helpers — canonicalizeRelayUrl, harvestRelays(db, urls) ($setOnInsert, never clobbers health), ensureRelayDirectoryIndex. Refactor the follows hose to use them (DRY).
• src/hoses/relaylists.js (kind 10002):
  • Verify the signature (content is free-form; not required to be JSON).
  • Latest-wins upsert of the raw event into relay_lists (keeps the existing shape diddoc reads).
  • Owns its indexes: pubkey, created_at.
  • Harvest r-tag URLs into the relays directory — the canonical relay-URL source, feeding the phase-4 health prober. (Enhancement over the old relayhose.)
• src/indexer.js: register the hose; LEGACY_KINDS becomes []. Make planIngest take the legacy-kind set as a parameter so the plan tests are self-contained (stop re-editing them each phase).
• Tests: relay-lists hose (verify / r-tag extraction / harvest); rework planIngest tests to inject legacy kinds.

Out of scope (later phases)

Active relay-health prober (kind-less; unfreezes /relays) — phase 4 · deploy + retire the legacy server hoses — phase 5.

Acceptance

• npm test green incl. new relay-lists tests.
• Every kind (0/3/10002) routes through a hose; INDEX_LEGACY_KINDS now gates an empty set (no behaviour change).
• Forged/tampered kind-10002 events rejected; r-tag URLs discovered into relays without clobbering existing health docs; did documents still resolve service from relay_lists.