ContextKit Explorer relay

Receives ContextKit rule webhooks, verifies their signatures, and
pushes them to a registered iPhone. Nothing to see here — this is
infrastructure for one person's test harness, not a web page.

  GET  /health         service status (public)
  POST /hooks/:slug    ContextKit posts here, authenticated by HMAC

Everything else needs the relay token.