Mobile app cannot onboard without the desktop app — no standalone identity path

## Problem

The mobile app can't be used without first going through the desktop app.
The desktop app is a first-class client — it creates its own identity and
connects directly to a relay. The mobile app is not: it has no independent
identity path. It must receive an identity via NIP-AB pairing from a
desktop app that already has one.

This means anyone running the relay and agents on a headless server has no
way to onboard a mobile device. The mobile app already has the full client
surface — channels, threads, search, forum, agents, reactions, profiles —
but there is no path to reach it.

## Workaround (what it takes today)

To get a phone connected without a desktop app, we had to:

1. Run `buzz-pairing-cli source` on the server to act as a headless
pairing source.
2. Fix a payload format incompatibility — the CLI sends `PayloadType::Nsec`
(raw nsec) but the mobile app expects `PayloadType::Custom` with
`{"relayUrl","pubkey","nsec"}`, the format the desktop app produces.
3. Fix a rustls `CryptoProvider` panic (#2308) when connecting over `wss://`.
4. Copy-paste the `nostrpair://` URI from a terminal to the phone.
5. Confirm the SAS code on both sides.

After these fixes, pairing succeeded and the mobile app connected. But this
is not a realistic path for users — it requires building from source,
patching the CLI, and juggling a terminal and a phone.

## What would help

Two reasonable approaches, neither available today:

- Mobile creates its own identity (keypair) and connects directly, the
same way the desktop app does.
- Mobile pairs with a headless identity source — the CLI already has a
relay URL and nsec, but has no `pair` command to transfer them.

Either would make the mobile app usable without a desktop app.

Related: #2324 (pairing docs assume desktop), #2682 (same deadlock —
proposed a web client to avoid the desktop dependency entirely).