feat(09-02): retire the bare-pubkey session path (BOT-01)

Client: useNostr.ts's auto-restore now calls GET /api/auth/me (a plain
authFetch, no body) instead of POSTing {pubkey} to /api/auth/login —
identity is derived server-side from the JWT alone, never claimed by
the client.

Server: POST /login is reduced to a pure, documented-deprecated read.
Removed the creator auto-create branch and the creator auto-upgrade
db.update block — an unauthenticated request can no longer mutate the
database via this endpoint. The identical creator auto-create/upgrade
logic already exists, correctly gated behind NIP-98 verification, in
POST /nostr/session, so a creator signing in with a real signer still
gets the same row created/upgraded. Added a handler doc comment plus a
new auth.test.ts case asserting an unregistered creator pubkey now
returns exists:false and leaves the bots table row count unchanged.

e2e/helpers/auth.ts: doc comments updated to describe loginWithPubkey
as a read-only test lookup helper, not a login; request/signature
unchanged so existing e2e specs keep working.

Verification: auth.test.ts + auth-edge.test.ts + auth-audit.test.ts +
auth-me.test.ts = 56/56 pass. Full server suite (bypassing pnpm's
install-gate via ./node_modules/.bin/vitest, since this environment's
pnpm needs an interactive build-approval step unrelated to this task)
= 810/817 pass, remaining 7 are pre-existing timing/perf flakes under
CPU load (lifecycle/speed-meta/tier-balance/bot-auth constant-time),
none touching auth. tsc (server) and vue-tsc (frontend) both exit 0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

e2e/helpers/auth.ts

@@ -1,26 +1,30 @@
 /**
  * E2E authentication helpers.
- * Provides programmatic login for tests without browser extension interaction.
+ * Provides a programmatic bot lookup for tests without browser extension interaction.
  */
 
 import { randomPubkey } from './setup.js'
 
 /**
  * Create a test identity (pubkey + nsec equivalent).
- * For E2E tests, we use direct pubkey-based login (legacy endpoint)
+ * For E2E tests, we use the read-only lookup helper below (loginWithPubkey)
  * since we can't interact with NIP-07 browser extensions.
  */
 export function createTestIdentity() {
   return {
     pubkey: randomPubkey(),
     // In a real NIP-98 flow, this would be a signed event
-    // For testing, we use the legacy login endpoint
+    // For testing, we use the deprecated read-only lookup endpoint
   }
 }
 
 /**
- * Login via legacy endpoint and get bot data.
- * Returns bot info if the pubkey has a registered bot.
+ * Look up a bot by pubkey via the deprecated, read-only POST /api/auth/login
+ * endpoint. This is NOT a login — it establishes no session and issues no
+ * token (D-01/BOT-01). It's kept only as a test helper: real session
+ * establishment goes through POST /api/auth/nostr/session (NIP-98) and
+ * session restoration through GET /api/auth/me (JWT). Returns bot info if
+ * the pubkey has a registered bot, `{}` otherwise.
  */
 export async function loginWithPubkey(baseURL: string, pubkey: string): Promise<{ bot?: { id: string; name: string } }> {
   const res = await fetch(`${baseURL}/api/auth/login`, {