Gate enterprise relay login on discovery

[bradseiler]

Summary

This adds the desktop client gate for enterprise relay login. When a relay advertises a privacy-safe federated_identity requirement through NIP-11, the client requires the trusted browserLogin flow before community admission.

The client treats relay discovery as a signal only. It still requires the selected relay to match trusted compile-time enterprise provider config, and it never reads login, assertion, provider, or credential URLs from NIP-11.

This PR also hardens the login lifecycle. It fences stale attempts, preserves cancel-before-native-registration tombstones, bounds tombstone retention, and commits session state while holding the browserLogin lock.

The Buzz client now consumes the revised BuilderLab identity response shape. It reads username and name from the exchange and /auth/me responses. It treats the profile as authoritative only when both independently trimmed values are present. When the authoritative corporate profile write fails, the flow stays non-editable and offers a retry that persists the same values.

Scope excludes session persistence, NIP-FI assertion issuance, NIP-42 relay auth, mobile support, and release-repo config.

Base: origin/main at 4e1770aa3ee7552e2bb50e897e113c22e30488de.
Head: 6ecda5ca0719a90e6c19bd5ee631a94e33acd67d.

Related issue

None found.

Testing

At 6ecda5ca0719a90e6c19bd5ee631a94e33acd67d:

• Focused desktop node tests — passed, 17 tests.
• cargo test --manifest-path desktop/src-tauri/Cargo.toml builderlab --no-fail-fast — passed, 15 relevant tests and 3231 filtered.
• pnpm --dir desktop typecheck — passed.
• biome check on touched desktop files — passed.
• Playwright end-to-end test authoritative corporate profile save failure stays non-editable and retries exact values — passed.
• Push hook after publishing 6ecda5ca0719a90e6c19bd5ee631a94e33acd67d — passed: push-head-scope, branch-skew, desktop-check, file-size-check, desktop-typecheck, desktop-test, and desktop-tauri-checks.
• Live-local relay workflow — passed with evidence in .scratch/enterprise-login-gate-live-6ecda5ca: built the release at the exact SHA, started the relay, confirmed readiness, created a channel, and sent/read a message. Docker CLI was unavailable because it required org sign-in, so the run used already-listening local Postgres and Redis ports with an isolated scratch database.

Generated with Codex

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is f18ea456984a1a94d444615fa3b38ec326a79793...6ecda5ca0719a90e6c19bd5ee631a94e33acd67d.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 6ecda5ca0719a90e6c19bd5ee631a94e33acd67d to authorize a new review.
Any previous review applies only to its recorded range.