Set Access-Control-Allow-Origin: * on /.well-known/nostr.json

NIP-05 requires this header so browser-based Nostr clients can validate
identities via fetch from any origin.

internal/http/handlers/nostrjson.go

@@ -12,6 +12,7 @@ type NostrJSON struct {
 }
 
 func (h *NostrJSON) Handle(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Access-Control-Allow-Origin", "*")
 	w.Header().Set("Cache-Control", "public, max-age=60")
 
 	names, err := h.Users.Repo().ActiveByName(r.Context())