feat(config): add repository whitelist for curated GRASP-01 acceptance

Adds NGIT_REPOSITORY_WHITELIST option for curated relay operation that
accepts only whitelisted repositories while maintaining GRASP-01 compliance
(announcements must list the service). This differs from archive whitelist
which enables GRASP-05 mode and doesn't require service listing.

Key features:
- Supports three whitelist formats: npub, npub/identifier, identifier
- Enforces mutual exclusivity with archive read-only mode
- Updates NIP-11 curation field when whitelist is enabled
- Maintains GRASP-01 compliance (doesn't add GRASP-05 support)

Configuration synced across all four sources: src/config.rs, docs/reference/configuration.md,
nix/module.nix, and .env.example as required by AGENTS.md.

1 files changed, 15 insertions, 0 deletions

diff --git a/nix/module.nix b/nix/module.nix
index 516fb04..d5dfd88 100644
--- a/nix/module.nix
+++ b/nix/module.nix
@@ -207,6 +207,20 @@ let
             - Repository announcements not listing this service are accepted per whitelist/archive-all
           Default: true if archiveAll or archiveWhitelist is set, false otherwise
           Note: Setting to true without archive config causes startup error
+          Note: Cannot be used with repositoryWhitelist (mutually exclusive)
+        '';
+      };
+
+      repositoryWhitelist = mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+        example = [ "npub1alice..." "npub1bob.../linux" "bitcoin-core" ];
+        description = ''
+          Repository whitelist for GRASP-01 acceptance.
+          Announcements must BOTH list our service AND match this whitelist.
+          Formats: <npub>, <npub>/<identifier>, <identifier>
+          Cannot be used with archiveReadOnly=true (mutually exclusive)
+          When set, NIP-11 curation field indicates curated repository acceptance
         '';
       };
 
@@ -252,6 +266,7 @@ let
         toString cfg.naughtyListExpirationHours;
       NGIT_ARCHIVE_ALL = toString cfg.archiveAll;
       NGIT_ARCHIVE_WHITELIST = concatStringsSep "," cfg.archiveWhitelist;
+      NGIT_REPOSITORY_WHITELIST = concatStringsSep "," cfg.repositoryWhitelist;
       RUST_LOG = cfg.logLevel;
     } // optionalAttrs (cfg.relayName != null) {
       NGIT_RELAY_NAME = cfg.relayName;