Companion 0.5.28 — backup & restore (#128), NIP-46 remote signer (#139), companion-gated install pitch (#61 residual)

The companion-agent queue from the 2026-08-30 handoff, complete:

- Backup & Restore: hub sub-page, SAF export/import sealed in the
  node's ADR-005 envelope (Argon2id + ChaCha20-Poly1305, byte-compatible
  with core backup.rs), merge-only restore, no cloud.
- Remote Signer: the phone is the NIP-46 bunker — nsec generate/import,
  nostrconnect:// QR pairing (scanner + OS deep link), per-request
  approve/deny card, NIP-44 v2 transport with NIP-04 receive fallback,
  wire-faithful to rust-nostr's reference bunker. Crypto pinned to the
  official NIP-44 + BIP-340 vectors; e2e harness included.
- #61 residual: banner + manual intro trigger + overlay all gate on
  isCompanionApp() (web-side, vitest-covered).
- Hub modal: new sub-pages like Nodes/FIPS, 70% height cap, node ULA
  display/copy in the Nodes list, fipssh Termux helper (npub→ULA is a
  pure public-key function — verified against the fips crate).

Issues #61 (comment), #128, #139 closed on the tracker.

neode-ui/src/components/CompanionIntroOverlay.vue

@@ -143,6 +143,7 @@ import { ref, onMounted, onUnmounted, watch } from 'vue'
 import * as QRCode from 'qrcode'
 import { IS_DEMO, DEMO_PASSWORD } from '@/composables/useDemoIntro'
 import { companionIntroRequested } from '@/composables/useCompanionIntro'
+import { isCompanionApp } from '@/utils/openExternal'
 import { useLoginTransitionStore } from '@/stores/loginTransition'
 import { useServerStore } from '@/stores/server'
 import { rpcClient } from '@/api/rpc-client'
@@ -205,10 +206,12 @@ const POST_INTRO_GRACE_MS = 2000
 
 let calmTicker: ReturnType<typeof setInterval> | null = null
 
-// Running inside the companion app's own WebView (it injects this JS bridge).
+// Running inside the companion app's own WebView (it injects the JS bridge —
+// detected with the canonical helper, not a raw window check, so the gate
+// is identical everywhere the question is asked).
 // The "get the companion app" pitch is nonsense there — the user is already in
 // it. Server management for connected companions lives in the NESMenu instead.
-const IN_COMPANION_APP = typeof (window as { ArchipelagoNative?: unknown }).ArchipelagoNative !== 'undefined'
+const IN_COMPANION_APP = isCompanionApp()
 
 onMounted(() => {
   if (IN_COMPANION_APP) return
@@ -247,9 +250,13 @@ function maybeShow() {
 }
 
 // Manual open (App Store banner etc.) — ignores the once-per-browser gate.
+// The trigger itself is already a no-op inside the companion (useCompanionIntro),
+// and this watcher refuses to open there too, so no caller can ever pop the
+// install pitch inside the app it installs (#61).
 watch(companionIntroRequested, (requested) => {
   if (!requested) return
   companionIntroRequested.value = false
+  if (IN_COMPANION_APP) return
   if (calmTicker) {
     clearInterval(calmTicker)
     calmTicker = null