feat(deploy): add device-pairing sidecar to the compose stack

[vishoo7]

Problem

Mobile QR pairing fails out of the box for deploy/compose deployments. A membership-gated (NIP-43) relay can't accept unpaired devices, so the desktop app falls back to pointing the phone at the legacy <relay>/pair path (resolve_pairing_relay_url in desktop/src-tauri/src/commands/pairing.rs). The compose stack never runs the buzz-pair-relay sidecar or routes /pair, so the phone's WebSocket upgrade lands on the main relay's router and pairing always dies with "websocket connection failed: http error: 404 not found".

The Helm chart already handles this (pairingRelay.enabled runs the sidecar from the relay image and advertises it in NIP-11); this PR brings the compose bundle to parity.

Changes

• compose.pair.yml (new overlay): runs /usr/local/bin/buzz-pair-relay from the existing relay image via an entrypoint: override (the image ENTRYPOINT is buzz-relay, so command: alone would silently start a second main relay), binds 0.0.0.0:5000, and adds a bash /dev/tcp healthcheck matching the relay's approach. It also sets BUZZ_PAIRING_RELAY_URL=wss://$BUZZ_DOMAIN/pair on the relay so clients get the pairing URL from NIP-11 instead of relying on the legacy path fallback.
• Caddyfile: exclusive handle blocks — /pair → pair-relay:5000, everything else → relay:3000.
• run.sh: includes the overlay by default when BUZZ_COMPOSE_TLS=true; BUZZ_COMPOSE_PAIRING=false opts out. Not wired for the non-TLS stack (no reverse proxy to route /pair, and iOS requires wss://).
• README.md: new "Device pairing" section with verification steps.

Testing

• docker compose -f compose.yml -f compose.caddy.yml -f compose.pair.yml config renders the merged stack correctly (sidecar entrypoint/env/healthcheck, relay BUZZ_PAIRING_RELAY_URL).
• Verified end-to-end on a live single-node VPS deployment of this stack: NIP-11 advertises pairing_relay_url, GET /pair returns the sidecar's 400 for non-WebSocket requests (previously the relay's 404), and iOS QR pairing against the desktop app completes through SAS confirmation.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Voret84oXtBS5hfRo66uGS

[air3ijai]

• fix(deploy): bundle buzz-pair-relay sidecar so mobile pairing works out of the box #2736
• fix(compose): restore mobile pairing sidecar #3627
• fix(compose): wire buzz-pair-relay so mobile QR pairing works #3875