feat: NIP-98 + JWT authentication with signer support

Replace insecure raw-pubkey auth with cryptographic NIP-98 signed
requests and server-issued JWT sessions. Logout now fully clears
all state including nsec. Add yellow "Use Nostr Signer" button
for Amber/NIP-07 remote signers.

- Server: JWT middleware (HMAC-SHA256, 24h expiry), NIP-98 verification
- Server: POST /api/auth/nostr/session endpoint
- Frontend: NIP-98 token builder + authFetch wrapper with JWT Bearer
- Frontend: All authenticated API calls use authFetch
- Security: logout clears JWT, pubkey, bot, nsec, and profile pic

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

frontend/src/components/BetPanel.vue

@@ -2,6 +2,7 @@
 import { ref, computed, onMounted } from 'vue'
 import { useWallet } from '../composables/useWallet'
 import { useNostr } from '../composables/useNostr'
+import { authFetch } from '../lib/nostr-auth'
 
 const props = defineProps<{
   fightId: string
@@ -65,7 +66,7 @@ async function placeBet() {
       body.cashuToken = cashuToken.value.trim()
     }
 
-    const res = await fetch('/api/bets/place', {
+    const res = await authFetch('/api/bets/place', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify(body),