Hosted communities: Cloudflare returns 403 for buzz-acp WebSocket upgrades on Windows

**Describe the bug**

On a Block-hosted `*.communities.buzz.xyz` community, Buzz Desktop can fetch the relay's NIP-11 metadata over HTTPS, but managed agents cannot establish the relay WebSocket connection. Cloudflare returns `HTTP 403 Forbidden` during the WebSocket upgrade, before NIP-42 authentication starts.

This reproduces with two separate managed Codex agent identities (Fizz and Honey). In both cases all `codex-acp` workers initialize successfully, then `buzz-acp` exits when its initial relay connection receives the Cloudflare 403.

**Steps to reproduce**

1. Install Buzz Desktop on Windows and connect it to a hosted `.communities.buzz.xyz` relay.
2. Create a managed Codex agent and start it.
3. Observe that `codex-acp` 1.1.9 initializes and the agent pool becomes ready.
4. Observe that the subsequent relay WebSocket connection fails with `HTTP error: 403 Forbidden`.
5. As an independent probe, request the NIP-11 document over HTTPS; it succeeds and reports Buzz Relay 0.2.0 with `auth_required: true`.
6. Send a standards-compliant WebSocket upgrade request to the same origin; Cloudflare returns 403 instead of 101.

Reproduction probe:

```powershell
curl.exe -sS -D - -o NUL --http1.1 --max-time 5 `
-H "Connection: Upgrade" `
-H "Upgrade: websocket" `
-H "Sec-WebSocket-Version: 13" `
-H "Sec-WebSocket-Key: SGVsbG9Xb3JsZDEyMzQ1Ng==" `
https://.communities.buzz.xyz/
```

This consistently returns:

```text
HTTP/1.1 403 Forbidden
Server: cloudflare
```

Adding a browser User-Agent, `Origin`, and Nostr `Accept` header does not change the result. The behavior was also reproduced through both a proxy route and a direct route.

**Expected behavior**

The hosted relay should accept the WebSocket upgrade (`101 Switching Protocols`), then perform the normal NIP-42 authentication and membership checks inside the established WebSocket connection.

**Version and platform**

- Buzz version: 0.5.5
- OS: Windows 11 Home, version 10.0.26200 (build 26200)
- ACP adapter: `@agentclientprotocol/codex-acp` 1.1.9
- Hosted relay NIP-11 version: 0.2.0

**Logs / additional context**

Representative agent log:

```text
INFO buzz_acp: agent initialized agent=9 name="@agentclientprotocol/codex-acp" steering_supported=true
INFO buzz_acp: agent_pool_ready agents=10
WARN buzz_acp::relay: initial relay connect failed with terminal error: WebSocket error: HTTP error: 403 Forbidden
Error: relay connect error: WebSocket error: HTTP error: 403 Forbidden
```

Representative edge response:

```text
Date: Thu, 06 Aug 2026 06:16:34 GMT
HTTP/1.1 403 Forbidden
Server: cloudflare
CF-RAY: a26be9e0df2c88bd-LAX
```

The Cloudflare response body says `Sorry, you have been blocked`. Because the rejection occurs during the HTTP upgrade, neither the managed agent's Nostr identity nor its `respond_to` mode has been evaluated yet. Please inspect the hosted-zone Cloudflare WAF/Bot Management rules for WebSocket upgrade requests to tenant community hostnames. The exact community hostname is available privately if needed.