feat: opt-in encrypted config backup

[deymosh]

Summary

An opt-in backup of the phone's setup, so a new or reinstalled phone with the same identity picks up where the old one left off.

• What is saved: only what the phone alone knows. That is each paired machine's relays, label, direct endpoints and new-session defaults; the settings; the quick prompts; and the session-key ring (secrets and expiries) with each machine's confirmed grant. What a bridge re-sends in its heartbeat is left out.
• How: one NIP-78 event (kind 30078) on a relay the user picks. The content is NIP-44 encrypted to the identity through the signer, so NIP-55 logins work too. The d tag is a hash of the identity and an app-private context, so it names neither the app nor the content. The backup relay joins the relay set, so the Tor and NIP-42 rules apply to it.
• When: 30 s after the last change worth backing up, only if the content changed, or on "Back up now". Turning it on looks on the relay first. A backup already there waits for Restore or Keep this phone's, and nothing is saved over it meanwhile.
• Restore merges. Missing machines are added, existing ones keep their own setup, and settings and quick prompts become the backup's. The backup's session keys are adopted only while the phone has granted none of its own, so a restored phone reads its bridges at once without a signer prompt per bridge. A session key never signs, so it cannot command a bridge, and only the identity can open the backup.
• Off: turning backup off can also send a NIP-09 deletion.
• Android:
  • a Settings → Backup page;
  • a one-time restore step right after logging in with an existing key;
  • Account → "Show" for the nsec of an on-device key, read off the main thread and copied as sensitive.

Commits

• client-core: backup payload, d tag, fingerprint, total decode, merge
• nostr-transport: #d filters
• client-runtime: seal/open/delete events, the save/fetch/import loop, intents, a two-phone round-trip test
• client-core: session keys + grants in the backup (adopt-only-if-unused rule, tests)
• client-ffi: intents, UniffiBackupView, nsec_of; bindings regenerated
• android: Backup page, restore step, show key; snapshots
• docs: CLIENT.md section

Test plan

• cargo clippy --workspace --all-targets -D warnings, cargo test --workspace
• agent-host typecheck + test
• Android testDebugUnitTest verifyPaparazziDebug (new goldens reviewed)
• Device test of a two-phone restore (maintainer, with the prerelease)

🤖 Generated with Claude Code