chore(relay): configure NIP-86 admins + systemd unit for Newlay

Document the two admin pubkeys' NIP-86 tier/assignments (verified admin 200 / non-admin 403 / no-auth 401) and add scripts/systemd/skatespots-relay.service for the host compose wrapper.

AGENTS.md

@@ -2086,9 +2086,18 @@ The community relay moved off the hosted relay.tools instance
 - **Data:** restored from the archive — **115/115 events, 17 authors**, every kind
   matching. LMDB + (unused) Blossom live in the Docker volume
   `newlay_newlay-data`.
-- **NIP-86:** Newlay advertises it, but admin rights must be configured relay-side;
+- **Admins / NIP-86 (2026-10-12):** `[tier.admin]` (`can_admin = true`) plus two
-  until then `src/lib/relayAdmin.ts` (`banevent`) 401s and the app falls back to
+  `[[assignment]]` rows grant the app's two admins (`20e7c953…` founder,
-  NIP-32 label hiding.
+  `caba497f…`) the NIP-86 management RPC that `src/lib/relayAdmin.ts` calls
+  (`banevent`, `listeventsneedingmoderation`, `getrelaystatus`, …). Verified with a
+  throwaway admin key: admin → 200 (method list), non-admin → 403, no auth → 401.
+  The app's admin hard-delete is now real on the relay (falls back to NIP-32 label
+  hiding only if NIP-86 is unreachable). Manage admins by editing
+  `~/newlay/deploy/docker/newlay.toml` and `docker compose up -d --force-recreate`.
+- **systemd:** the host runs `skatespots-relay.service` (a `docker compose` wrapper,
+  `enable --now`; tracked at `scripts/systemd/skatespots-relay.service`). Restart
+  with `sudo systemctl restart skatespots-relay`. The container also carries
+  `restart: unless-stopped`.
 - **Cutover (2026-10-12):** `SKATE_RELAY` (`src/lib/types.ts`) → the new relay; the
   default pools, the DM/CVM/zap relay arrays, the `cvm-server` + `push-service`
   defaults, and the archive default all point at the new relay **with the legacy

scripts/systemd/skatespots-relay.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=SkateSpots community relay (Newlay via Docker Compose)
+Documentation=https://code.relay.tools/opensauce/newlay
+Requires=docker.service
+After=docker.service network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+WorkingDirectory=/home/ubuntu/newlay
+ExecStart=/usr/bin/docker compose up -d
+ExecStop=/usr/bin/docker compose down
+TimeoutStartSec=0
+
+[Install]
+WantedBy=multi-user.target