#121 feat(server): issue relaycast ar_ws_ credentials behind /v1/relaycast

Summary

RelayAuth becomes the credential authority for relaycast (model B — remote issuance). This adds a /v1/relaycast route group that mints ar_ws_ credentials and serves the credential tags relaycast needs to verify them.

• Vendored ar_ codec + snowflake ID generation — no relaycast dependency.
• Keyring env: RELAYAUTH_RELAYCAST_CREDENTIAL_KEYRING (active + retired keys for tag verification).
• Push envs: RELAYAUTH_RELAYCAST_URL + RELAYAUTH_RELAYCAST_INTERNAL_SECRET / RELAYAUTH_RELAYCAST_INTERNAL_SECRET_FILE — newly issued keys are pushed to relaycast's /internal key ingestion.
• Routes (all behind scope relayauth:relaycast:manage:* — the sdk scope parser can't parse admin, hence manage):
  • POST /v1/relaycast/workspaces — provision a relaycast workspace + issue its first ar_ws_ API key.
  • GET /v1/relaycast/credential-tags/:wsid — base62 wsid segment; returns { ok: true, data: { tags } }, the contract relaycast's remoteCredentialTagger consumes.
  • POST /v1/relaycast/workspaces/:id/api-key — mint an additional ar_ws_ key for an existing workspace.
• 758 tests pass; tag output interop-verified against relaycast's own signer.

Test plan

• npm run typecheck
• npm test — 758 passing
• Route contract verified against relaycast remoteCredentialTagger (GET /v1/relaycast/credential-tags/:wsid → { ok, data: { tags } })

Generated with Devin

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}