fix(desktop): only proxy relay-origin Blossom URLs in media rewriter

[wesbillman]

Summary

• Bug: rewriteRelayUrl() matched any Blossom-patterned URL regardless of domain, then proxied it through the Sprout relay. External Blossom avatar URLs (e.g. nostr.build) got fetched from the wrong server → 404 → missing avatars on desktop while mobile loaded them fine.
• Fix: Fetch and cache the relay origin via get_relay_http_url at module init. Only URLs matching the relay origin are proxied; external Blossom URLs pass through unchanged to WKWebView.
• Safe fallback: Before the relay origin is cached (brief startup window), all Blossom URLs are proxied as before — relay URLs behind Cloudflare Access still get the proxy they need.

Test plan

• Verify user with external Blossom avatar (e.g. baxen) shows avatar on desktop
• Verify users with relay-hosted avatars still display correctly
• Verify avatars still load after cold start (race condition window)

Notable review notes

Beth flagged two CHANGE items (not blockers):

1. Brief race window before cachedRelayOrigin resolves — strictly better than old behavior (always 404), and get_relay_http_url is a sync Rust call behind IPC so it resolves nearly instantly
2. No retry if get_relay_http_url IPC fails — low risk since the command is a sync env-var read, and failure reverts to old behavior

🤖 Generated with Claude Code