feat: implement GET /v1/devices/:id/relay for relay endpoint discovery #39

Summary#

Implements GET /v1/devices/:id/relay (MM-88): authenticated with device_token, returns relay_url, websocket_url, and optional iroh_endpoint from relay config
Adds IrohConfig.endpoint: Option<String> to common config (TOML: [iroh] endpoint = "...", omitted = None)
Adds require_device_token(headers, device_id, db) auth helper — scopes auth to both token hash and device ID path param, so a token from device A cannot authenticate requests for device B
Adds seed_device test helper to test_utils for use across device-auth route tests

cargo test -p relay get_device_relay — 8 tests: 200 with correct URLs, relay_url matches config, websocket uses wss://, iroh_endpoint absent/present, 401 for no auth / wrong token / cross-device token
cargo test -p relay device_token — 4 unit tests for require_device_token
cargo test -p common iroh_endpoint — 2 config parsing tests
cargo clippy --workspace -- -D warnings — clean
cargo fmt --all --check — clean
Manual: register a device via POST /v1/devices, call GET /v1/devices/:id/relay with the returned deviceToken in Bruno