fix: generated identity uses extension signer instead of local key

buildNip98Token checked window.nostr before secretKeyHex, so
"Generate New Identity" would sign with the browser extension's key
after saving. Now explicit keys always take priority over extensions.

Also made setup flow mode-aware: webhook users get BOTFIGHTS-WEBHOOK.md,
polling users get BOTFIGHTS-POLLING.md with matching copy prompts.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

frontend/src/lib/nostr-auth.ts

@@ -68,19 +68,21 @@ export async function buildNip98Token(
 
   let signedEvent: Record<string, unknown>
 
-  const signer = (window as { nostr?: NostrSigner }).nostr
-  if (signer) {
-    // Sign via NIP-07 extension or Amber
-    signedEvent = await signer.signEvent(unsignedEvent)
-  } else if (secretKeyHex) {
-    // Sign locally with secret key
+  if (secretKeyHex) {
+    // Sign locally with provided secret key — always prefer explicit key over extension
     const { hexToBytes } = await import('nostr-tools/utils')
     const { finalizeEvent } = await import('nostr-tools')
     const sk = hexToBytes(secretKeyHex)
     const event = finalizeEvent(unsignedEvent, sk)
     signedEvent = event as unknown as Record<string, unknown>
   } else {
-    throw new Error('No Nostr signer available. Install a NIP-07 extension or use a saved key.')
+    const signer = (window as { nostr?: NostrSigner }).nostr
+    if (signer) {
+      // Sign via NIP-07 extension or Amber
+      signedEvent = await signer.signEvent(unsignedEvent)
+    } else {
+      throw new Error('No Nostr signer available. Install a NIP-07 extension or use a saved key.')
+    }
   }
 
   return btoa(JSON.stringify(signedEvent))