feat: fix setup guide download with embedded credentials + profile page regenerate secret

- downloadSetupGuide() now triggers a real file download with bot_id/secret injected
- Add POST /api/auth/regenerate-secret endpoint (JWT auth, 3/hour rate limit)
- Add "Download Setup Guide" section to BotProfilePage with secret regeneration flow
- Old secret immediately invalidated on regeneration

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

frontend/src/composables/useNostr.ts

@@ -388,6 +388,22 @@ export function useNostr() {
     return { latencyMs: data.latencyMs || 0 }
   }
 
+  async function regenerateSecret(): Promise<{ botId: string; secret: string }> {
+    if (!pubkey.value) throw new Error('Not logged in')
+
+    const res = await authFetch('/api/auth/regenerate-secret', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+    })
+
+    const data = await res.json()
+    if (!res.ok) {
+      throw new Error(data.error || 'Failed to regenerate secret')
+    }
+
+    return { botId: data.botId, secret: data.secret }
+  }
+
   async function registerHuman(name: string, avatarSeed?: string): Promise<BotData> {
     if (!pubkey.value) throw new Error('Not logged in')
 
@@ -547,6 +563,7 @@ export function useNostr() {
     registerHuman,
     updateCustomization,
     updateWebhook,
+    regenerateSecret,
     getStoredNsec,
     persistKey,
     logout,