NIP-46 sign-in: remote-signer sessions behind the same facade, memory-only

Implements login-methods.md §LM5 phase one. Core gains nostr/nip46.ts -- a
Nip46Client speaking kind-24133 RPC with NIP-44 transport encryption,
bunker:// parsing, nostrconnect listen (secret echo is proof-of-scan),
auth_url surfacing, and typed deadline errors -- plus subscribeLive on
RelayConnection with re-REQ on reconnect, and live post-EOSE delivery in
the MockRelay so tests exercise real round trips against a fake bunker.

The ephemeral client key and Nip46Client live in the crypto worker
(§LM5.4); nip46* actions bypass the serial queue so a signer waiting
minutes for human approval cannot block other worker calls, and the
signer's auth_url reaches the UI as the worker's first notification frame.

The widget's connect screen runs both legs at once: a nostrconnect QR --
rendered as dot-style inline SVG with rounded finder eyes, per owner
preference -- for phone signers, and a bunker:// paste box (password
input; the URI carries a token). window.nostr is now an element-routed
provider, so a NIP-46 session claims the slot and hosts reading it get
the remote signer transparently; NIP-07 still leaves the slot to the
extension. Sessions stay thin per §LM7: no vault, no persistence.
Persistence remains gated on the external vault review (§LM5.3).

14 new tests (core fake-bunker e2e, QR geometry, signer delegation) and
two policy pins: bunker option below the password path, element stays
web-storage-free.

Co-Authored-By: Claude Fable 5 <[email protected]>

docs/login-methods.md

@@ -1,10 +1,14 @@
 # BitLogin as the Single Login Surface — NIP-07 and NIP-46 Methods
 
-**Document version:** 0.2
-**Status:** §LM4 (NIP-07) is **implemented** (2026-08-04): `signers/` in
-`@bitlogin/widget`, thin sessions per §LM7, password-first presentation per
-§LM9.1. §LM5 (NIP-46) remains a proposal. §LM6 records a settled rejection
-(nsec paste as a login method), kept on the record.
+**Document version:** 0.3
+**Status:** §LM4 (NIP-07) and §LM5 (NIP-46, memory-only phase) are
+**implemented** (2026-08-04): `signers/` in `@bitlogin/widget`, the NIP-46
+client in `@bitlogin/core`'s `nostr/nip46.ts` with the ephemeral key held in
+the crypto worker, both `bunker://` paste and the nostrconnect QR (rendered
+as dot-style inline SVG), thin sessions per §LM7, password-first per §LM9.1.
+NIP-46 *persistence* (§LM5.3 phase two) remains gated on the external vault
+review. §LM6 records a settled rejection (nsec paste as a login method),
+kept on the record.
 **Depends on:** `docs/spec.md` (§ references point there unless marked §LM or
 §SF), `docs/second-factor.md` §SF10 (imported identities, implemented)
 
@@ -214,9 +218,11 @@ not propose.
 
 1. **NIP-07** — smallest increment: detection, delegation, capability
    probing, arbitration inversion. No new secrets, no relay traffic, no
-   review gate touched.
-2. **NIP-46, memory-only** — connect ceremony, pending/timeout UX, typed
-   errors. Still nothing persisted.
+   review gate touched. **Shipped 2026-08-04.**
+2. **NIP-46, memory-only** — connect ceremony (bunker:// paste and a
+   nostrconnect QR), pending/timeout UX, typed errors. Still nothing
+   persisted. **Shipped 2026-08-04.** Transport is NIP-44 only, per the
+   current NIP-46 spec; legacy NIP-04-only bunkers are not supported.
 3. **NIP-46 persistence as a vault profile** — after the external security
    review the vault is already gated on.