[pbuzdin]

PR: feat: run iroh-relay 1.0 next to 0.35, advertise via irohrelay1 metadata

Closes #1010 (relay-side counterpart of chatmail/core#8182).

What it does

• Deploys the iroh-relay 1.0 line (v1.3.0, pinned musl artifacts) as a
  second systemd service, plain HTTP on 127.0.0.1:3342, enabled whenever
  the local 0.35 relay runs.
• Serves it publicly through nginx on its own TLS port 3341 (same
  cert as the main host, /relay, /ping, /generate_204 proxied to
  3342).
• New chatmail.ini option iroh_relay_1, mirroring iroh_relay
  semantics:
  • unset (default) → https://<domain>:3341 while the 0.35 relay runs
  • custom URL → local 1.0 service disabled, users directed to that URL
  • empty string → nothing advertised for the 1.0 line
• Advertises the URL through the new IMAP METADATA item
  /shared/vendor/deltachat/irohrelay1, so core PR #8182 can discover
  1.0 relays without breaking iroh 0.35 clients (they keep reading
  irohrelay).

Why a separate port (co-hosting decision for #1010)

Iroh clients overwrite the RelayUrl path before dialling
(dial_url.set_path(RELAY_PATH), iroh-relay src/client.rs), so two relay
versions cannot share one origin at different paths. Same hostname on a
different port works: the port is part of the authority and survives
set_path. This keeps 0.35 untouched on the main HTTPS origin and answers
the issue's preference to "run both" without a synchronized cutover.

Verification

• iroh-relay v1.3.0 booted locally with the shipped iroh-relay-1.toml:
  /ping → 200, /generate_204 → 204, /relay → 400 (upgrade required,
  expected without WS headers).
• nginx.conf.j2 renders against a real Config (1× listen 3341 ssl,
  +IPv6, 3× upstream refs).
• chatmaild suite: 121 passed incl. 3 new tests
  (iroh_relay_1 config defaults/custom/empty/external-relay cases,
  irohrelay/irohrelay1 metadata lookups, empty → N).
• Artifact sha256s are the upstream v1.3.0 musl release tarballs.

Notes for reviewers

• enable_stun from the 0.35 config was removed in 1.0 (as anticipated in
  the 0.35 config comment) — the new toml omits it.
• No QUIC endpoint is exposed (parity with the current 0.35 deployment,
  which runs plain HTTP behind nginx; QUIC addr discovery needs relay-side
  TLS). Clients fall back to HTTPS/WebSocket.
• Core-side follow-up (feat: upgrade to Iroh 1.0 core#8182): read
  /shared/vendor/deltachat/irohrelay1 in imap.rs fetch_metadata and
  feed it to the iroh 1.0 endpoint setup.