Mobile-only community owner has no recovery or administration path

## Summary

A hosted-community owner can retain the valid owner identity on Buzz Mobile yet be unable to recover Desktop access or administer the community. Mobile exposes neither a secure identity export/reveal nor the owner-only member-administration flow needed to admit a replacement Desktop key.

## Incident

After Desktop lost the founder's owner identity, the phone remained logged in with the true owner key. The community had exactly one member row, the owner. Source inspection showed:

- Desktop pairing is source-only: Desktop sends its nsec to Mobile; Mobile cannot send the identity back.
- Mobile offers no nsec reveal/export.
- Mobile offers no member-administration UI that could add or elevate a replacement Desktop identity.
- Relay administration authorizes against the signer's own member row.
- NIP-OA delegation gives an agent access through the owner but does not grant owner/admin rights.

The corrected incident record is public at https://github.com/Seven-Day-Inc/centrifuge/issues/301#issuecomment-5133776152.

## Expected behavior

A still-authenticated owner on Mobile needs at least one secure, supported recovery path:

1. An encrypted identity export that can be imported on Desktop, **or**
2. An owner-only mobile flow to add/elevate a replacement identity, with clear confirmation and audit evidence.

Ideally both exist, with the app prompting owners to establish and verify a second recovery copy before they become single-device owners.

## Impact

The owner could still use the account on Mobile but could not restore Desktop ownership. Recovery required relay-operator intervention or rebuilding the community and re-minting every agent identity, auth tag, and host configuration.

Start by tracing the Desktop pairing path and the Mobile identity and member-administration flows described in the incident, then inspect how relay administration authorizes against a member row. Determine whether the supported recovery path is encrypted identity export, owner-only replacement administration, or both. Done means a still-authenticated Mobile owner can securely recover Desktop access or elevate a replacement identity, with clear confirmation and audit evidence.

Written by the indexing model from the issue text.