relay: loopback default bind + sanitize channel logs + install/update artifacts (NA-0162)

[Tebbens4832]

Goals:

• Enforce NA-0162 relay hardening invariants in qsl-server.
• Provide reproducible Ubuntu install/update artifacts with safe defaults.

Impact:

• Default bind is now loopback (127.0.0.1) unless explicit opt-in is provided via CLI/env (--bind / BIND_ADDR).
• Startup fails deterministically with clear error markers on invalid bind/port env/parse/listen failures.
• Push/pull logs are capability-safe: raw channel values are replaced with deterministic channel_id=<hashprefix>.
• Added deployment artifacts for systemd + env file + Caddy and idempotent install/update scripts.

No-regression:

• Existing push/pull/auth/queue tests remain green.
• Added regression tests for loopback default/opt-in bind and raw-channel log redaction.
• No bearer token or payload value is logged.

Tests:

• cargo fmt -- --check
• cargo test --locked
• cargo clippy --all-targets -- -D warnings

Adjacency scan:

• Commands run:
  • rg -n "0\.0\.0\.0|127\.0\.0\.1|::1|SocketAddr|bind\(|listen\(|serve\(|PORT|addr|host|BIND_ADDR" -S .
  • rg -n "channel=|channel|/v1/push|/v1/pull|push\b|pull\b" -S .
  • rg -n "Authorization|Bearer" -S .
• Files/functions inspected:
  • src/main.rs: Cli, env resolution, bind parsing/listen startup path.
  • src/lib.rs: /v1/push/:channel, /v1/pull/:channel, auth gate and logging callsites.
  • tests/relay_smoke.rs + unit tests in src/lib.rs and src/main.rs.

Deployment notes:

• New templates:
  • packaging/systemd/qsl-server.service
  • packaging/systemd/relay.env.example
  • packaging/caddy/Caddyfile.example
• New scripts:
  • scripts/install_ubuntu.sh (idempotent install, env 0600, does not overwrite existing env)
  • scripts/update_ubuntu.sh (binary-only update, preserves env)

Invariant statement now test-proven:

• Default deployment binds loopback-only, and relay logs never include raw channel tokens.