buzz-pair source: payload format mismatch breaks mobile credential import (raw nsec sent instead of JSON object)

## Root Cause

CLI `resolve_payload()` sends a **raw nsec string** as the payload, but the mobile app's `_processPayload()` calls `jsonDecode(payload)` expecting a **JSON object** with `relayUrl`, `pubkey`, `nsec` fields.

The "space in nsec" is a display artifact — the real error is `FormatException` from `jsonDecode` choking on a non-JSON string.

## Steps to Reproduce

1. Run `buzz-pair source --relay ws://:3000`
2. Scan QR with Buzz mobile app
3. Complete SAS verification
4. Phone shows: `Failed to import credentials: FormatException: Unexpected character (at character 1)`

## Fix

`resolve_payload()` now constructs a JSON payload matching the mobile app's expected format:

```json
{"relayUrl":"ws://relay:3000","pubkey":"","nsec":"nsec1..."}
```

Changes in `crates/buzz-pairing-cli/src/main.rs`:
- Accepts `relay_url` parameter
- Derives pubkey from SecretKey (both `--nsec` and generated paths)
- Serializes as JSON object

Fix builds cleanly. Ready for PR.

## Environment

- Relay: ws://100.110.236.104:3000 (Tailscale)
- Built from `main`, Rust 1.97 nightly
- Mobile: Buzz for Android/iOS (Flutter)