feat(config): add repository whitelist for curated GRASP-01 acceptance

Adds NGIT_REPOSITORY_WHITELIST option for curated relay operation that
accepts only whitelisted repositories while maintaining GRASP-01 compliance
(announcements must list the service). This differs from archive whitelist
which enables GRASP-05 mode and doesn't require service listing.

Key features:
- Supports three whitelist formats: npub, npub/identifier, identifier
- Enforces mutual exclusivity with archive read-only mode
- Updates NIP-11 curation field when whitelist is enabled
- Maintains GRASP-01 compliance (doesn't add GRASP-05 support)

Configuration synced across all four sources: src/config.rs, docs/reference/configuration.md,
nix/module.nix, and .env.example as required by AGENTS.md.

1 files changed, 5 insertions, 9 deletions

diff --git a/src/nostr/policy/announcement.rs b/src/nostr/policy/announcement.rs
index db87976..15a6e58 100644
--- a/src/nostr/policy/announcement.rs
+++ b/src/nostr/policy/announcement.rs
@@ -5,7 +5,7 @@
 use nostr_relay_builder::prelude::{Alphabet, Event, Filter, Kind, PublicKey, SingleLetterTag};
 
 use super::PolicyContext;
-use crate::config::ArchiveConfig;
+use crate::config::Config;
 use crate::nostr::events::{validate_announcement, RepositoryAnnouncement};
 
 /// Result of announcement policy evaluation
@@ -25,15 +25,12 @@ pub enum AnnouncementResult {
 #[derive(Clone)]
 pub struct AnnouncementPolicy {
     ctx: PolicyContext,
-    archive_config: ArchiveConfig,
+    config: Config,
 }
 
 impl AnnouncementPolicy {
-    pub fn new(ctx: PolicyContext, archive_config: ArchiveConfig) -> Self {
-        Self {
-            ctx,
-            archive_config,
-        }
+    pub fn new(ctx: PolicyContext, config: Config) -> Self {
+        Self { ctx, config }
     }
 
     /// Validate a repository announcement event
@@ -44,8 +41,7 @@ impl AnnouncementPolicy {
     /// or `Reject` with reason.
     pub async fn validate(&self, event: &Event) -> AnnouncementResult {
         // First, try validation (GRASP-01 + GRASP-05)
-        let validation_result =
-            validate_announcement(event, &self.ctx.domain, &self.archive_config);
+        let validation_result = validate_announcement(event, &self.config);
 
         match validation_result {
             AnnouncementResult::Reject(reason) => {