Implement relay naughty list feature

Add naughty list tracking for relays with persistent infrastructure issues
(DNS failures, TLS certificate errors, protocol violations) to reduce log
noise and provide better visibility via metrics.

Key features:
- Classify errors into naughty (persistent) vs transient (temporary)
- Track naughty relays with category, reason, and occurrence count
- Log WARN on first naughty occurrence, DEBUG on repeats
- Automatic expiration after 12 hours (configurable)
- Prometheus metrics for monitoring naughty relays by category
- Periodic cleanup task integrated with health checker

Components added:
- src/sync/naughty_list.rs: Core naughty list tracker with error classification
- NaughtyListTracker integration in RelayHealthTracker
- Connection error handling updates in sync manager
- Naughty list metrics (total by category, detailed info per relay)
- Config option for naughty_list_expiration_hours (default: 12)

Closes DNS lookup failures and TLS certificate errors tracking issues.

1 files changed, 7 insertions, 0 deletions

diff --git a/src/config.rs b/src/config.rs
index 44001d8..74327c9 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -156,6 +156,12 @@ pub struct Config {
         default_value_t = 604800
     )]
     pub rejected_cold_index_expiry_secs: u64,
+
+    /// Hours before removing relay from naughty list (default: 12)
+    /// Relays with persistent infrastructure issues (DNS, TLS, protocol errors) are
+    /// tracked separately and retried after this expiration period.
+    #[arg(long, env = "NGIT_NAUGHTY_LIST_EXPIRATION_HOURS", default_value_t = 12)]
+    pub naughty_list_expiration_hours: u64,
 }
 
 impl Config {
@@ -281,6 +287,7 @@ impl Config {
             sync_disable_negentropy: false,
             rejected_hot_cache_duration_secs: 120,
             rejected_cold_index_expiry_secs: 604800,
+            naughty_list_expiration_hours: 12,
         }
     }
 }