Retrofit: fix stale command docs, extract relay-client guide

- Replace the Commands-table Lint/Type-check TODOs with the real, verified
  commands: `npm run check` (tsc --noEmit over startos/) and `npm run prettier`.
  There is no ESLint/linter; server/ JS is untooled.
- Move the client-side relay contract (env vars, /relay/* endpoints, X-Recap-*
  headers, file map) out of AGENTS.md into docs/guides/relay-client.md with
  paths: frontmatter, lazy-loaded via a .claude/rules symlink; AGENTS.md keeps
  a one-line pointer.
- Un-ignore .claude/rules/ so the guide auto-attaches in any clone, while
  .claude/ local state (worktrees, plans) stays ignored.

AGENTS.md

@@ -24,8 +24,8 @@ Run from repo root unless noted.
 | Build `.s9pk` (x86) | `make x86` |
 | Bump version (interactive) | `make bump` |
 | Install to local StartOS | `make install` *(see Always/Never — bump first; the binary is `start-cli` under the hood)* |
-| Lint | TODO — no `lint` script in `server/package.json`. Add one if you want it. |
-| Type-check | TODO — there's a top-level `tsconfig.json` but the server is all `.js`. Confirm intent before assuming. |
+| Type-check (StartOS TS) | `npm run check` *(repo root; runs `tsc --noEmit` over `startos/**/*.ts`. The `server/` is plain JS and is not type-checked.)* |
+| Format (StartOS TS) | `npm run prettier` *(repo root; `prettier --write startos`. There is **no** ESLint/linter — `server/` JS is untooled. Many `startos/versions/*.ts` are currently unformatted.)* |
 
 Mode is selected at boot via the `RECAP_MODE` env var: `single` (default) or `multi`.
 
@@ -83,12 +83,7 @@ vendor/keysat-licensing-client/   local-link Keysat SDK
 
 ### Client-side contract with the relay
 
-Endpoint shapes + auth model are documented canonically in `../recap-relay/AGENTS.md`. The client side is:
-
-- **Env vars** — `RECAP_RELAY_BASE_URL` (default `https://relay.recaps.cc`) + `RECAP_RELAY_OPERATOR_KEY` (matches the relay's `relay_cloud_operator_key`). Both gitignored; reference names, never values. Resolved in `server/relay-default.js` and `server/config.js`.
-- **Auth direction (what the client SENDS)** — cloud calls send `X-Recap-Operator-Key` + `X-Recap-User-Id`; self-hosted calls send `X-Recap-Install-Id` (+ optional `Authorization: <license>`). Set the same `X-Recap-Job-Id` on transcribe + analyze in one summary so the relay bills one credit, not two.
-- **Endpoints called** — `/relay/{transcribe, transcribe-url, jobs/:id, summarize-url, summarize-url/:jobId/events, analyze, tts, balance, capabilities, policy, credits/packages, credits/buy, credits/invoice/:id, user-tier, user-tier/:id, tier-invoice, tier-zaprite-order, tier-plans, expiring-subscriptions}`. Settle webhooks land on the relay side, never here.
-- **Files** — `server/providers/relay.js` (transcribe/summarize/analyze/tts + balance + tier reads/writes), `server/relay-capabilities.js` (capabilities poll), `server/billing-routes.js` (tier purchase orchestration), `server/credits-purchase.js` (credit-pack purchase proxy), `server/subscription-reminders.js` (polls `/relay/expiring-subscriptions`). (`/relay/policy` is a small inline proxy in `index.js`.)
+The full client-side relay contract — env vars, the `/relay/*` endpoint list, `X-Recap-*` header directions, and the file map — lives in **`docs/guides/relay-client.md`**. Read it before editing `server/providers/relay.js`, `relay-capabilities.js`, `relay-default.js`, `billing-routes.js`, `credits-purchase.js`, `subscription-reminders.js`, or the relay env-var resolution in `config.js`. Canonical endpoint shapes are in `../recap-relay/AGENTS.md`.
 
 ### Cross-repo changes (sibling: `../recap-relay`)