Adds an idempotent setup script and justfile recipe so that connecting
a Goose agent to a local Sprout relay is a single command:
just goose
What this does:
- scripts/setup-goose-agent.sh: mints a Nostr keypair + API token on
first run, persists to .sprout-agent.env (gitignored, chmod 600).
Subsequent runs are a no-op.
- justfile: 'just goose' sources the agent env and launches goose with
the sprout-mcp-server extension.
- .gitignore: excludes .sprout-agent.env.
Also fixes a bug where API token authentication was not wired up in the
relay's NIP-42 auth handler. The AuthService intentionally has no DB
access, so sprout_ tokens need to be intercepted in handle_auth before
calling verify_auth_event. The handler now:
1. Extracts the auth_token tag from the NIP-42 event
2. If it starts with sprout_, hashes it, looks it up via
Db::get_api_token_by_hash, and delegates to
AuthService::verify_api_token_against_hash
3. Updates last_used_at on success
4. Falls through to the existing JWT/no-token paths otherwise
Bradley Axen