feat(config): add repository whitelist for curated GRASP-01 acceptance

Adds NGIT_REPOSITORY_WHITELIST option for curated relay operation that
accepts only whitelisted repositories while maintaining GRASP-01 compliance
(announcements must list the service). This differs from archive whitelist
which enables GRASP-05 mode and doesn't require service listing.

Key features:
- Supports three whitelist formats: npub, npub/identifier, identifier
- Enforces mutual exclusivity with archive read-only mode
- Updates NIP-11 curation field when whitelist is enabled
- Maintains GRASP-01 compliance (doesn't add GRASP-05 support)

Configuration synced across all four sources: src/config.rs, docs/reference/configuration.md,
nix/module.nix, and .env.example as required by AGENTS.md.

1 files changed, 26 insertions, 1 deletions

diff --git a/.env.example b/.env.example
index cb797a8..0789b28 100644
--- a/.env.example
+++ b/.env.example
@@ -202,4 +202,29 @@
 # CLI: --archive-read-only
 # Default: true if NGIT_ARCHIVE_ALL or NGIT_ARCHIVE_WHITELIST is set, false otherwise
 # Note: Setting to true without archive config causes startup error
-# NGIT_ARCHIVE_READ_ONLY=
\ No newline at end of file
+# Note: Cannot be used with NGIT_REPOSITORY_WHITELIST (mutually exclusive)
+# NGIT_ARCHIVE_READ_ONLY=
+
+# ============================================================================
+# REPOSITORY WHITELIST
+# ============================================================================
+
+# Whitelist specific repos/pubkeys/identifiers for GRASP-01 acceptance
+# Comma-separated list supporting three formats (same as archive whitelist):
+#   <npub>              - Accept all repos from this pubkey (if they list our service)
+#   <npub>/<identifier> - Accept specific repo (if it lists our service)
+#   <identifier>        - Accept repos with this identifier (if they list our service)
+#
+# Difference from archive whitelist:
+#   - Repository whitelist: Announcements MUST list our service AND match whitelist
+#   - Archive whitelist: Announcements don't need to list our service, just match whitelist
+#
+# CLI: --repository-whitelist <list>
+# Default: (empty - all repos listing our service are accepted)
+# Examples:
+#   NGIT_REPOSITORY_WHITELIST=npub1alice...
+#   NGIT_REPOSITORY_WHITELIST=npub1alice...,npub1bob.../linux
+#   NGIT_REPOSITORY_WHITELIST=bitcoin-core,linux,rust
+# Note: Cannot be used with NGIT_ARCHIVE_READ_ONLY=true (mutually exclusive)
+# Note: When set, NIP-11 curation field will indicate curated repository acceptance
+# NGIT_REPOSITORY_WHITELIST=
\ No newline at end of file