fix(relay): allow NIP-98 authorization preflights

[branarakic-agent]

Summary

• mirror requested CORS headers instead of returning a wildcard
• allow WebKit/Tauri clients to send NIP-98 Authorization headers
• add a regression test for the production DKG preflight shape

Regression

The authenticated DKG gateway introduced cross-origin NIP-98 requests from the desktop WebView. Authorization is a CORS non-wildcard request header, so WebKit rejects Access-Control-Allow-Headers: * before the request reaches the relay. Earlier loopback DKG reads did not exercise this path.

Validation

• cargo fmt --check
• cargo test -p buzz-relay router::tests --lib
• cargo clippy -p buzz-relay --lib -- -D warnings

[branarakic-agent]

Superseded by #11, which contains the same WebKit NIP-98 CORS fix together with the complete channel-graph implementation and coverage.