Add BitLogin as the primary sign-in method (gated, unstable)

The login modal now shows <bitlogin-auth> -- a portable Nostr identity
behind a login name and password -- as the default sign-in path,
styled with bitvid's own brand tokens (accent-strong, surfaces, radii).
The existing NIP-07 extension, nsec, and NIP-46 remote-signer options
still work exactly as before, just collapsed under a new "Other login
options" fold instead of a flat "Available methods" grid; nip07 no
longer carries the stale "Recommended" eyebrow now that BitLogin has
that role.

BitLogin isn't a single button-click-then-await-a-promise flow like
the other providers -- it's a whole multi-screen sign-in/create/recover
UI -- so it gets a permanent, statically-declared widget in
components/login-modal.html (js/ui/bitloginModalIntegration.js relocates
it, never destroys and recreates it, since removal tears down its crypto
Web Worker) instead of a grid button. It still goes through the exact
same session-establishment path as every other signer: a new "bitlogin"
provider (js/services/authProviders/bitlogin.js) lets AuthService
resolve and activate it via the normal requestLogin -> handleAuthLogin
path, while providersForModal excludes it from the grid so it isn't
rendered twice.

Two things this needed beyond the wiring itself:
- js/app.js is one line from its lint/file-size ceiling, so the only
  change there is renaming an import binding (providers -> providersForModal),
  a net-zero line change. The actual widget/event wiring lives in a new,
  unconstrained module instead.
- The login modal's HTML (including the permanent widget element) loads
  asynchronously after bootstrap runs, so wireBitloginLogin() waits via
  MutationObserver rather than assuming a specific call order.

Vendored via scripts/build-bitlogin-widget.mjs (mirrors the existing
Bitcoin Connect/Blossom vendor steps): BitLogin isn't published to npm,
so the widget build is copied verbatim from the sibling ../bitlogin
checkout into committed vendor/bitlogin/, then lazy-imported (like
Bitcoin Connect) so its ~350KB never weighs on visitors who never open
the login modal.

Gated behind FEATURE_BITLOGIN (config/instance-config.js), default on
for this unstable-branch experiment per AGENTS.md §1 -- reset to false
before this reaches main until verified end-to-end against production
relays.

Verified: npm run lint (clean), the full auth/login test suite (43/43,
including new coverage for the provider + adapter), and a manual
Chrome pass against the built dist/ -- widget renders themed correctly,
"Other login options" still shows the original four methods unchanged.

components/login-modal.html

@@ -47,27 +47,50 @@
     >
       <div class="space-y-2 text-left">
         <p class="text-sm text-text-muted">
-          Choose how you'd like to sign in. Connect a browser extension, link a
-          remote signer, or work directly with your keys when you need to.
+          Sign in with a login name and password that works the same on every
+          BitLogin site, or use one of the other options below.
         </p>
       </div>
 
-      <section
-        class="space-y-5 rounded-3xl border border-border bg-overlay-panel-soft/90 p-4 shadow-lg backdrop-blur-sm sm:p-5"
+      <!--
+        Permanent, statically-declared mount for <bitlogin-auth> -- never
+        written by an innerHTML re-render (this markup never changes after
+        the page loads), so the element is only ever hidden/shown, never
+        destroyed and recreated. Removing it from the DOM tears down its
+        crypto Web Worker (see BitLogin's README).
+      -->
+      <div
+        id="bitloginMount"
+        class="rounded-3xl border border-border bg-overlay-panel-soft/90 p-4 shadow-lg backdrop-blur-sm sm:p-5"
       >
-        <div class="space-y-1">
-          <h3 class="text-base font-semibold text-text">Available methods</h3>
-          <p class="text-sm text-text-muted">
-            Pick the option that matches how you manage your Nostr identity.
-          </p>
-        </div>
+        <bitlogin-auth
+          id="bitloginWidget"
+          vault-relays="wss://relay.damus.io,wss://nos.lol,wss://relay.nostr.band"
+          discovery-relays="wss://purplepag.es,wss://relay.nostr.band"
+        ></bitlogin-auth>
+      </div>
 
-        <!-- Login provider buttons are rendered dynamically -->
-        <div
-          data-login-providers
-          class="grid auto-rows-fr gap-4 sm:grid-cols-2 xl:grid-cols-3"
-        ></div>
-      </section>
+      <details class="space-y-3">
+        <summary class="cursor-pointer text-sm font-semibold text-text-muted hover:text-text">
+          Other login options
+        </summary>
+        <section
+          class="mt-3 space-y-5 rounded-3xl border border-border bg-overlay-panel-soft/90 p-4 shadow-lg backdrop-blur-sm sm:p-5"
+        >
+          <div class="space-y-1">
+            <h3 class="text-base font-semibold text-text">Available methods</h3>
+            <p class="text-sm text-text-muted">
+              Pick the option that matches how you manage your Nostr identity.
+            </p>
+          </div>
+
+          <!-- Login provider buttons are rendered dynamically -->
+          <div
+            data-login-providers
+            class="grid auto-rows-fr gap-4 sm:grid-cols-2 xl:grid-cols-3"
+          ></div>
+        </section>
+      </details>
 
       <div class="space-y-3">
         <div class="space-y-1 text-left">