refactor(auth): consolidate login logic in NostrClient and enhance security

- Move NIP-07 extension login logic from `js/services/authProviders/nip07.js` to `NostrClient.loginWithExtension`.
- Add `validator` support to `NostrClient` login methods (`loginWithExtension`, `connectRemoteSigner`, `useStoredRemoteSigner`, `registerPrivateKeySigner`) to allow pre-session security checks.
- Update `nip07.js`, `nip46.js`, and `nsec.js` providers to inject `accessControl` checks via the new validator hook, ensuring consistent enforcement of whitelists/blacklists before activating the signer.
- This creates a unified "harness" for all signing methods within `NostrClient` while keeping business logic (access control) in the service layer.

Co-authored-by: PR0M3TH3AN <[email protected]>

scripts/agent/test-nip07-refactor.mjs

@@ -0,0 +1,70 @@
+import './setup-test-env.js';
+import { NostrClient, getActiveSigner } from '../../js/nostr/client.js';
+// import { userLogger, devLogger } from '../../js/utils/logger.js';
+
+// Polyfill window.nostr
+const mockPubkey = "0000000000000000000000000000000000000000000000000000000000000001";
+const mockNostr = {
+  getPublicKey: async () => mockPubkey,
+  signEvent: async (e) => {
+    e.sig = "mock-sig";
+    e.id = "mock-id";
+    return e;
+  },
+  nip04: {
+    encrypt: async () => "mock-ciphertext",
+    decrypt: async () => "mock-plaintext"
+  }
+};
+
+global.window.nostr = mockNostr;
+
+async function run() {
+  console.log("Starting NIP-07 Refactor Verification...");
+
+  const client = new NostrClient();
+  // Skip client.init() to avoid network/relay connection attempts in this isolated test
+  // await client.init();
+
+  console.log("Testing loginWithExtension...");
+  try {
+    const result = await client.loginWithExtension();
+    console.log("Login returned:", { pubkey: result.pubkey, hasSigner: !!result.signer });
+
+    if (result.pubkey !== mockPubkey) {
+      throw new Error(`Pubkey mismatch: expected ${mockPubkey}, got ${result.pubkey}`);
+    }
+
+    const activeSigner = getActiveSigner();
+    if (!activeSigner) {
+      throw new Error("Active signer was not set!");
+    }
+
+    if (activeSigner.pubkey !== mockPubkey) {
+        throw new Error(`Active signer pubkey mismatch: ${activeSigner.pubkey}`);
+    }
+
+    console.log("Testing validator failure...");
+    try {
+      await client.loginWithExtension({
+        validator: async () => false // should fail
+      });
+      console.error("Validator failure test FAILED: Should have thrown error");
+      process.exit(1);
+    } catch (error) {
+      if (error.message.includes("Access denied")) {
+        console.log("Validator failure test SUCCESS!");
+      } else {
+        console.error("Validator failure test FAILED: Wrong error", error);
+        process.exit(1);
+      }
+    }
+
+    console.log("Verification SUCCESS!");
+  } catch (error) {
+    console.error("Verification FAILED:", error);
+    process.exit(1);
+  }
+}
+
+run();