fix(chart): route /pair to the pairing relay in default HTTPRoute and Ingress rules

deploy/charts/buzz/templates/httproute.yaml

@@ -17,6 +17,22 @@ spec:
     {{- if .Values.httproute.rules }}
     {{- toYaml .Values.httproute.rules | nindent 4 }}
     {{- else }}
+    {{- if .Values.pairingRelay.enabled }}
+    {{- /* NIP-AB device pairing: clients resolve the pairing relay from the
+         NIP-11 `pairing_relay_url`, falling back to the legacy `/pair` path
+         on the main relay URL. Both conventions land on this host, so the
+         default route must peel `/pair` off to the pairing sidecar — the
+         main relay serves no `/pair` route and would 404 mobile pairing.
+         Gateway API prefers the most specific path match, so rule order is
+         cosmetic. */}}
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /pair
+      backendRefs:
+        - name: {{ include "buzz.fullname" . }}-pairing
+          port: {{ .Values.pairingRelay.service.port }}
+    {{- end }}
     - matches:
         - path:
             type: PathPrefix

deploy/charts/buzz/templates/ingress.yaml

@@ -39,5 +39,18 @@ spec:
                 port:
                   number: {{ $svcPort }}
           {{- end }}
+          {{- if $.Values.pairingRelay.enabled }}
+          {{- /* Same reason as the HTTPRoute default rules: the legacy client
+               fallback is `/pair` on the relay host, and the main relay 404s
+               it. Longest-path matching sends `/pair` here, everything else
+               to the relay. */}}
+          - path: /pair
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ $fullName }}-pairing
+                port:
+                  number: {{ $.Values.pairingRelay.service.port }}
+          {{- end }}
     {{- end }}
 {{- end }}

deploy/charts/buzz/tests/networking_test.yaml

@@ -77,3 +77,78 @@ tests:
           path: kind
           value: HTTPRoute
         template: templates/httproute.yaml
+      - notContains:
+          path: spec.rules
+          content:
+            matches:
+              - path:
+                  type: PathPrefix
+                  value: /pair
+            backendRefs:
+              - name: RELEASE-NAME-buzz-pairing
+                port: 5000
+        template: templates/httproute.yaml
+
+  - it: HTTPRoute default rules route /pair to the pairing relay when enabled
+    set:
+      relayUrl: wss://buzz.example.com
+      ownerPubkey: "0000000000000000000000000000000000000000000000000000000000000000"
+      externalPostgresql.url: postgres://u:p@h:5432/d
+      externalRedis.url: redis://h:6379
+      s3.endpoint: http://minio:9000
+      s3.accessKey: a
+      s3.secretKey: s
+      httproute.enabled: true
+      httproute.parentRefs:
+        - name: my-gateway
+          namespace: gateway-system
+      pairingRelay.enabled: true
+      pairingRelay.url: wss://pairing.example.com
+    asserts:
+      - contains:
+          path: spec.rules
+          content:
+            matches:
+              - path:
+                  type: PathPrefix
+                  value: /pair
+            backendRefs:
+              - name: RELEASE-NAME-buzz-pairing
+                port: 5000
+        template: templates/httproute.yaml
+      - contains:
+          path: spec.rules
+          content:
+            matches:
+              - path:
+                  type: PathPrefix
+                  value: /
+            backendRefs:
+              - name: RELEASE-NAME-buzz
+                port: 3000
+        template: templates/httproute.yaml
+
+  - it: Ingress default host routes /pair to the pairing relay when enabled
+    set:
+      relayUrl: wss://buzz.example.com
+      ownerPubkey: "0000000000000000000000000000000000000000000000000000000000000000"
+      externalPostgresql.url: postgres://u:p@h:5432/d
+      externalRedis.url: redis://h:6379
+      s3.endpoint: http://minio:9000
+      s3.accessKey: a
+      s3.secretKey: s
+      ingress.enabled: true
+      pairingRelay.enabled: true
+      pairingRelay.url: wss://pairing.example.com
+    asserts:
+      - contains:
+          path: spec.rules[0].http.paths
+          content:
+            path: /pair
+            pathType: Prefix
+            backend:
+              service:
+                name: RELEASE-NAME-buzz-pairing
+                port:
+                  number: 5000
+        template: templates/ingress.yaml