fix: extract NIP-OA owner on open relays for observer frame auth

[tlongwell-block]

Problem

On open Sprout relays (require_relay_membership = false), managed agents cannot publish kind:24200 observer frames because the relay's handle_agent_observer_event() requires an agent→owner mapping in the DB. This mapping is normally written during NIP-OA auth, but on open relays the enforce_relay_membership() function short-circuits with return Ok(None) before extracting the NIP-OA owner — so the mapping never gets written.

Root Cause

In crates/sprout-relay/src/api/mod.rs, enforce_relay_membership() returns Ok(None) immediately when require_relay_membership = false, skipping NIP-OA owner extraction entirely. The auth handler then sees nip_oa_owner = None and skips the DB backfill.

Fix

1. extract_nip_oa_owner helper — pure function that validates a NIP-OA auth tag and returns the owner pubkey (no side effects, no membership checks)
2. Auth handler — on open relays, calls extract_nip_oa_owner directly when the membership gate returns None, enabling the existing DB backfill path
3. enforce_relay_membership unchanged — stays a pure gate function for all other callers (HTTP, media, git, audio)

Design Decisions

• Semantic separation: extraction ≠ enforcement. The helper is testable in isolation.
• Gated explicitly: !state.config.require_relay_membership && state.config.allow_nip_oa_auth
• First-write-wins: existing conflict resolution in the auth handler handles re-registrations
• 3 unit tests cover the helper directly

Files Changed

• crates/sprout-relay/src/api/mod.rs — extract_nip_oa_owner helper + tests + doc update
• crates/sprout-relay/src/handlers/auth.rs — open-relay NIP-OA backfill call
• crates/sprout-relay/src/config.rs — allow_nip_oa_auth doc comment update

Testing

• All 148 relay tests pass
• All 35 auth tests pass
• cargo clippy clean
• cargo fmt clean