Add multi-tenant cloud mode: self-serve purchase, credit metering, core-decoupling

Introduces RECAP_MODE=multi alongside single-mode self-host:
- Tenant auth + accounts (magic-link via System SMTP), per-tenant credit pool,
  anonymous trial minting with per-IP/-64 caps
- Self-serve Pro/Max purchase: inline Lightning (BTCPay) + card (Zaprite),
  prepaid 30-day periods, expiry-reminder emails
- Core-decoupling: relay owns cloud tier/expiry keyed by Recaps user-id
- SQLite (better-sqlite3) schema for multi-mode; filesystem unchanged for single
- StartOS actions/versions through 0.2.155

server/relay-default.js

@@ -10,9 +10,28 @@
 // Override at runtime via the RECAP_RELAY_BASE_URL env var for local
 // dev testing only — there's no StartOS action exposed for this, so
 // production installs always use the hardcoded value.
-const DEFAULT_RELAY_BASE_URL = "https://relay.keysat.xyz";
+import { relayOperatorKey } from "./config.js";
+
+const DEFAULT_RELAY_BASE_URL = "https://relay.recaps.cc";
 
 export function getRelayBaseURL() {
   const fromEnv = (process.env.RECAP_RELAY_BASE_URL || "").trim();
   return fromEnv || DEFAULT_RELAY_BASE_URL;
 }
+
+// Shared "operator key" (core-decoupling): the secret that authenticates
+// THIS cloud Recaps server to the relay so it can vouch for its signed-in
+// users by account-id (X-Recap-User-Id) instead of attaching a per-user
+// Keysat license. Set the SAME value in the relay's relay_cloud_operator_key.
+// Empty = cloud user-id identity is disabled; paid users fall back to the
+// operator pool. Server-side only — never sent to the browser.
+//
+// Resolution: the RECAP_RELAY_OPERATOR_KEY env var pins it (local dev);
+// otherwise the value comes from the StartOS config sidecar via config.js's
+// polled `relayOperatorKey` live binding (set by the "Set Relay Operator
+// Key" action, picked up within one poll — no restart needed).
+export function getRelayOperatorKey() {
+  const fromEnv = (process.env.RECAP_RELAY_OPERATOR_KEY || "").trim();
+  if (fromEnv) return fromEnv;
+  return (relayOperatorKey || "").trim();
+}