feat(grasp-05): add read-only mode with auto-enable for archive configs

Implements NGIT_ARCHIVE_READ_ONLY configuration option that defaults to true
when archive mode is enabled, allowing relays to operate as read-only syncs
of archived repositories.

Key changes:
- Add NGIT_ARCHIVE_READ_ONLY config option (defaults to true if archive enabled)
- NIP-11 advertises GRASP-05 support and includes curation field when read-only
- Validation logic rejects non-whitelisted repos in read-only mode
- Comprehensive tests for read-only behavior and defaults
- Full documentation in config reference, .env.example, and NixOS module

Read-only mode enables passive mirroring without being listed in announcements,
useful for backup/archive operations while preventing accidental write acceptance.

1 files changed, 16 insertions, 0 deletions

diff --git a/nix/module.nix b/nix/module.nix
index f82f069..516fb04 100644
--- a/nix/module.nix
+++ b/nix/module.nix
@@ -196,6 +196,20 @@ let
         '';
       };
 
+      archiveReadOnly = mkOption {
+        type = types.nullOr types.bool;
+        default = null;
+        description = ''
+          Archive read-only mode (relay is read-only sync of archived repositories).
+          When true:
+            - NIP-11 includes GRASP-05 in supported_grasps
+            - NIP-11 curation field describes archive scope
+            - Repository announcements not listing this service are accepted per whitelist/archive-all
+          Default: true if archiveAll or archiveWhitelist is set, false otherwise
+          Note: Setting to true without archive config causes startup error
+        '';
+      };
+
       user = mkOption {
         type = types.str;
         default = "ngit-grasp-${name}";
@@ -241,6 +255,8 @@ let
       RUST_LOG = cfg.logLevel;
     } // optionalAttrs (cfg.relayName != null) {
       NGIT_RELAY_NAME = cfg.relayName;
+    } // optionalAttrs (cfg.archiveReadOnly != null) {
+      NGIT_ARCHIVE_READ_ONLY = toString cfg.archiveReadOnly;
     } // optionalAttrs cfg.metricsEnabled { NGIT_METRICS_ENABLED = "true"; }
       // optionalAttrs (cfg.syncBootstrapRelayUrl != null) {
         NGIT_SYNC_BOOTSTRAP_RELAY_URL = cfg.syncBootstrapRelayUrl;