feat: SSE live fight spectating with spectator count

Enable real-time fight spectating for all live fights (not just human
fights). Multiple spectators can watch simultaneously via SSE. Spectator
count is tracked per-fight and broadcast with every SSE event.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

frontend/src/composables/useWallet.ts

@@ -38,9 +38,14 @@ function parseNwcUrl(url: string): NwcConfig {
   const relay = params.get('relay')
   const secret = params.get('secret')
   if (!pubkey || !relay || !secret) {
-    throw new Error('Invalid NWC URL')
+    throw new Error('Invalid NWC URL: missing pubkey, relay, or secret')
   }
-  return { pubkey, relay, secret: hexToBytes(secret) }
+  // Validate hex before parsing — must be even-length hex string
+  const trimmed = secret.trim()
+  if (trimmed.length === 0 || trimmed.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(trimmed)) {
+    throw new Error('Invalid NWC URL: secret is not valid hex (must be even-length hex string)')
+  }
+  return { pubkey, relay, secret: hexToBytes(trimmed) }
 }
 
 export function useWallet() {
@@ -159,7 +164,11 @@ export function useWallet() {
 
       // If NWC connected, auto-pay via NWC and confirm directly
       const nwcUrl = localStorage.getItem('bf_nwc_url')
+      let nwcValid = false
       if (nwcUrl) {
+        try { parseNwcUrl(nwcUrl); nwcValid = true } catch { /* bad stored URL — fall through to poll */ }
+      }
+      if (nwcUrl && nwcValid) {
         paymentStatus.value = 'paying'
         const preimage = await payViaNWC(nwcUrl, bolt11)