feat: Support NIP-46 Remote Signing aka nsec bunker

Exposing private keys to different clients is a dangerous pattern clients should not encourage. If at all feasible, the app should build on remote signers or discourage pasting existing keys or at the very least allow power users to use a remote signing device.

Nostr does not support key rotation or sub-keys, so users end up with their keys being handled by multiple clients on multiple devices and sometimes even online services. Most social clients these days support nip46.

Start by tracing how the app currently handles private keys and signing, then read the NIP-46 remote-signing specification. Define the supported remote-signer flow and how existing key-pasting behavior should change. Done means users can use a remote signing device without exposing private keys, with the behavior covered by appropriate tests.

Written by the indexing model from the issue text.