fix(feed): always reserve live default relays in the feed set

The video feed's getDefaultRelays only fell back to bitvid's default relays
when the healthy set was COMPLETELY empty. A user whose own relays are all dead
but not yet probed (so they still pass the liveness filter) would have the feed
subscribe to that fully-broken list and hang forever on "Fetching…" — the
default aggregators were never injected.

Route the healthy set through capReadRelays (via new buildFeedRelaySet), which
always reserves a couple of reliable aggregator slots. Now the feed can reach
live relays regardless of how broken the user's personal list is, while still
prioritizing the user's own relays and bounding REQ fan-out to MAX_SUBSCRIBE_RELAYS.

Tests (buildFeedRelaySet): an all-dead user list still yields a default
aggregator while keeping the user's relays; empty input falls back to defaults;
an empty healthy set uses the configured fallback yet still reserves defaults; a
huge list stays bounded. Mutation-verified — reverting to the old
healthy-or-defaults logic fails 3 of the 4 scenarios.

Build + full lint green.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

js/nostr/client.js

@@ -121,6 +121,7 @@ import {
   DEFAULT_RELAY_URLS,
   RELAY_URLS,
   capReadRelays,
+  buildFeedRelaySet,
   ensureNostrTools,
   getCachedNostrTools,
   nostrToolsBootstrapFailure,
@@ -3574,7 +3575,11 @@ export class NostrClient {
         getPool: () => this.pool,
         getDefaultRelays: () => {
           const healthy = sanitizeRelayList(this.getHealthyRelays(this.relays));
-          return healthy.length ? healthy : Array.from(DEFAULT_RELAY_URLS);
+          // Guarantee reliable default aggregators are always in the feed set,
+          // even when the user's own relays survive the health filter but are
+          // actually dead — otherwise the feed subscribes to a fully-broken
+          // list and hangs forever on "Fetching…".
+          return buildFeedRelaySet(healthy, this.relays);
         },
         // Own registry, isolated from the global singleton (which other
         // subsystems use for their own keys) and from other client instances.

js/nostr/toolkit.js

@@ -102,6 +102,28 @@ export function capReadRelays(urls) {
   ).slice(0, MAX_SUBSCRIBE_RELAYS);
 }
 
+// Build the relay set for the main video feed.
+//
+// The subtle failure this guards: a user whose own relays are all DEAD but not
+// yet probed (so they still pass the liveness filter) would otherwise have the
+// feed subscribe only to those dead relays and hang on "Fetching…" forever,
+// because the known-good defaults were never injected. capReadRelays always
+// reserves a couple of reliable aggregator slots, so routing the healthy set
+// through it guarantees the feed can reach live relays even when the user's
+// entire personal list is broken. Falls back to the full default set if nothing
+// survives at all.
+export function buildFeedRelaySet(healthyRelays, fallbackRelays = []) {
+  const healthy = Array.isArray(healthyRelays)
+    ? healthyRelays.filter((u) => typeof u === "string" && u.trim())
+    : [];
+  const fallback = Array.isArray(fallbackRelays)
+    ? fallbackRelays.filter((u) => typeof u === "string" && u.trim())
+    : [];
+  const base = healthy.length ? healthy : fallback;
+  const capped = capReadRelays(base);
+  return capped.length ? capped : Array.from(DEFAULT_RELAY_URLS);
+}
+
 const globalScope =
   typeof window !== "undefined"
     ? window