recovery: private lists, reliable delivery, broader imports and portable backups

[FelineStateMachine]

Motivation

Close four practical relay gaps: recover accidentally replaced lists, keep a failed delivery target from losing its backlog, import history from relays without NIP-77, and recover a small relay with its files and Git data.

Change

• Private list history for follows, relay lists and bookmarks, bounded per list, signer and relay. Restore shows tag changes and requires a fresh client signature. Author deletion and expiration apply to history.
• Independent persistent rebroadcast cursors and bounded retries per target. Opt-in NIP-65 routing uses locally stored relay lists, with visible results, finite retries, queue limits and privacy checks. Imports do not trigger automatic routing.
• NIP-77-first imports fall back to resumable NIP-01 time windows. Each source reports complete, best-effort, partial, refused or failed results; one failed source does not block later sources.
• Owner-authenticated portable backups include configuration, signed events, list history, hidden/pending state, media and Git objects. Fresh-target preview and restore use distinct signed endpoints, integrity checks, capped streaming input, file staging and an atomic database apply. Restore controls appear before claiming a target.

The first backup format is capped at 8 MiB and 12,000 entries; memory budgeting can refuse a smaller archive. It excludes credentials, relay private keys, fuel credits, custom domains, leases, succession, callback registrations, previous archives and transient jobs. The target receives a fresh relay identity; clients must republish signed service references for moved site/Git URLs. Larger relays retain the separate dump/configuration/Blossom/Git export paths.

Testing Completed

• npm run typecheck passes, including generated assets and console startup checks.
• Full suite: npm test -- --maxWorkers=1, 53 files and 274 tests pass.
• Final delivery changes: jobs/delivery regression suites, 9 tests pass.
• Console JavaScript smoke check exercises job polling, delivery results, backup actions and list history with a stub DOM.
• HTTP tests cover preview immutability, distinct preview/restore authorization, successful fresh-target restore, tampered bodies, wrong owners, upload limits and exposure checks.

Responsible AI disclosure

Implemented with Codex and subagents. Changes were integrated and checked with the tests above; human review is requested before merge.