feat: NIP-98 + JWT authentication with signer support

Replace insecure raw-pubkey auth with cryptographic NIP-98 signed
requests and server-issued JWT sessions. Logout now fully clears
all state including nsec. Add yellow "Use Nostr Signer" button
for Amber/NIP-07 remote signers.

- Server: JWT middleware (HMAC-SHA256, 24h expiry), NIP-98 verification
- Server: POST /api/auth/nostr/session endpoint
- Frontend: NIP-98 token builder + authFetch wrapper with JWT Bearer
- Frontend: All authenticated API calls use authFetch
- Security: logout clears JWT, pubkey, bot, nsec, and profile pic

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/middleware/jwt.ts

@@ -0,0 +1,67 @@
+import { createHmac, randomBytes } from 'crypto'
+import { logger } from '../lib/logger.js'
+
+const JWT_SECRET = process.env.JWT_SECRET || randomBytes(32).toString('hex')
+const JWT_EXPIRY = 24 * 60 * 60 // 24 hours
+
+if (!process.env.JWT_SECRET) {
+  logger.warn('jwt', 'JWT_SECRET not set — tokens will invalidate on server restart')
+}
+
+interface JwtPayload {
+  sub: string        // Nostr pubkey (hex)
+  botId?: string     // Bot ID if registered
+  iat: number        // Issued at
+  exp: number        // Expiration
+}
+
+function b64url(data: string | Buffer): string {
+  const buf = typeof data === 'string' ? Buffer.from(data) : data
+  return buf.toString('base64url')
+}
+
+export function createJwt(pubkey: string, botId?: string): string {
+  const header = b64url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }))
+  const now = Math.floor(Date.now() / 1000)
+  const payload: JwtPayload = {
+    sub: pubkey,
+    ...(botId ? { botId } : {}),
+    iat: now,
+    exp: now + JWT_EXPIRY,
+  }
+  const payloadStr = b64url(JSON.stringify(payload))
+  const signature = createHmac('sha256', JWT_SECRET)
+    .update(`${header}.${payloadStr}`)
+    .digest('base64url')
+
+  return `${header}.${payloadStr}.${signature}`
+}
+
+export function verifyJwt(token: string): JwtPayload | null {
+  try {
+    const parts = token.split('.')
+    if (parts.length !== 3) return null
+
+    const [header, payload, signature] = parts
+    const expectedSig = createHmac('sha256', JWT_SECRET)
+      .update(`${header}.${payload}`)
+      .digest('base64url')
+
+    if (signature !== expectedSig) return null
+
+    const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString()) as JwtPayload
+    const now = Math.floor(Date.now() / 1000)
+    if (decoded.exp && decoded.exp <= now) return null
+
+    return decoded
+  } catch {
+    return null
+  }
+}
+
+/** Extract pubkey from JWT Bearer token in Authorization header, or return null */
+export function extractPubkeyFromAuth(authHeader: string | undefined): string | null {
+  if (!authHeader?.startsWith('Bearer ')) return null
+  const payload = verifyJwt(authHeader.slice(7))
+  return payload?.sub || null
+}

server/src/middleware/nip98.ts

@@ -0,0 +1,78 @@
+import { verifyEvent } from 'nostr-tools'
+
+interface Nip98Result {
+  valid: boolean
+  pubkey?: string
+  error?: string
+}
+
+/**
+ * Verify a NIP-98 HTTP Auth event from the Authorization or nostr-authorization header.
+ * Expects format: "Nostr <base64-encoded-signed-event>"
+ *
+ * Validates:
+ * - Event kind is 27235
+ * - URL path matches the request path
+ * - HTTP method matches
+ * - created_at is within 120 seconds of now
+ * - Schnorr signature is valid
+ */
+export function verifyNip98Token(
+  authHeader: string,
+  requestPath: string,
+  requestMethod: string,
+): Nip98Result {
+  try {
+    const match = authHeader.match(/^Nostr\s+(.+)$/i)
+    if (!match) return { valid: false, error: 'Invalid auth header format' }
+
+    let eventJson: string
+    try {
+      eventJson = Buffer.from(match[1], 'base64').toString('utf-8')
+    } catch {
+      return { valid: false, error: 'Invalid base64 encoding' }
+    }
+
+    const event = JSON.parse(eventJson)
+
+    // Verify kind 27235
+    if (event.kind !== 27235) {
+      return { valid: false, error: 'Wrong event kind (expected 27235)' }
+    }
+
+    // Verify URL tag — compare path component only (works behind proxies)
+    const urlTag = event.tags?.find((t: string[]) => t[0] === 'u')
+    if (!urlTag || !urlTag[1]) {
+      return { valid: false, error: 'Missing URL tag' }
+    }
+    try {
+      const eventPath = new URL(urlTag[1]).pathname
+      if (eventPath !== requestPath) {
+        return { valid: false, error: `URL path mismatch: ${eventPath} !== ${requestPath}` }
+      }
+    } catch {
+      return { valid: false, error: 'Invalid URL in event tag' }
+    }
+
+    // Verify method tag
+    const methodTag = event.tags?.find((t: string[]) => t[0] === 'method')
+    if (!methodTag || methodTag[1].toUpperCase() !== requestMethod.toUpperCase()) {
+      return { valid: false, error: 'Method mismatch' }
+    }
+
+    // Verify created_at is recent (within 120 seconds)
+    const now = Math.floor(Date.now() / 1000)
+    if (Math.abs(now - event.created_at) > 120) {
+      return { valid: false, error: 'Event expired or clock drift too large' }
+    }
+
+    // Verify schnorr signature
+    if (!verifyEvent(event)) {
+      return { valid: false, error: 'Invalid signature' }
+    }
+
+    return { valid: true, pubkey: event.pubkey }
+  } catch (err) {
+    return { valid: false, error: 'Failed to parse NIP-98 token' }
+  }
+}