feat(relay): allow HTTP operator listener delivery URLs (#8287)

## Summary

Operator listener configuration currently rejects HTTP URLs, preventing
delivery to sibling services over internal HTTP connections. Accept HTTP
and HTTPS delivery URLs while retaining the existing pubkey,
duplicate-route, and URL restrictions.

Add configuration coverage for internal hostnames and custom ports,
verify signed delivery through the real HTTP client, and include the
listener suite in both unit-test runners. Shared NIP-98 signing and push
gateway code are unchanged.

### Related issue

Related: #7934 refactors operator listener delivery tests. No matching
open issue found.

### Testing

- `cargo test -p buzz-relay --lib operator_listener`: 13 passed,
including signed HTTP delivery and redirect rejection.
- `cargo fmt --all -- --check`, shell syntax, Justfile parsing, and diff
whitespace checks passed.
- `just test`: passed.
- `just ci`: stopped at mobile analysis with an existing undefined
`buzzDevPushAppProfile` in
`mobile/test/features/settings/notification_toggle_test.dart:81`.
Workspace and native desktop formatting/Clippy, desktop frontend checks,
and web checks passed. The mobile file is unchanged by this PR.

Locally verified with a spiked listener client

Signed-off-by: jsibbison-square <jsibbison@squareup.com>

.env.example

@@ -150,6 +150,8 @@ BUZZ_PUSH_GATEWAY_DELIVERY_URL=https://push.buzz.xyz/v1/deliveries/apns
 
 # Deployment-global operator-listener routes. Each configured Nostr identity
 # may register target pubkeys and receives mention notifications at its URL.
+# URLs may use HTTP or HTTPS. Use HTTP only for operator-controlled internal
+# connections: NIP-98 signs requests.
 # Format: pubkey:deliveryUrl;pubkey:deliveryUrl
 # BUZZ_OPERATOR_LISTENER_TIMEOUT_MS=5000
 # BUZZ_OPERATOR_LISTENERS=<64-char hex pubkey>:https://listener.example/mentions