feat(nip66): add shared relay probe engine (DNS, TLS, WS RTT, NIP-11)

[Ferryx349]

Summary

Add a reusable probe engine that measures external relay reachability.

Problem

Nostream has no built-in way to verify external relay reachability (DNS, TLS, WebSocket latency, NIP-11). Operators today SSH in and run manual dig / curl / openssl checks, or rely on third-party monitors.

The parent NIP-66 epic adds a cluster worker, admin panel, and kind 30166 / 10166 publishing. All of that depends on a shared probe module, this issue delivers that foundation.

Goal

Implement runProbe(publicRelayUrl) (or equivalent) that returns structured per-check results:

Check	What it answers
DNS	Does the relay’s public hostname resolve? (A, AAAA, CNAME, TTL)
TLS	Is the certificate valid? When does it expire? Who issued it?
WebSocket	What is open RTT to the relay from outside the process? (v1: rtt-open only)
NIP-11	Does GET / with Accept: application/nostr+json return valid relay metadata?

[Ferryx349]

Part of #667