nostrconnect:// client-initiated connections (NIP-46)

[sepehr-safari]

What

Support the client-initiated NIP-46 connection flow (nostrconnect://) alongside the signer-initiated bunker:// flow Signet ships today.

Why

Right now the only way to link a client is the signer-initiated flow: Signet shows a bunker://<pubkey>?relay=…&secret=… URI after unlock and you paste it into the client. Many clients prefer the reverse — they generate a nostrconnect:// URI (often as a QR) and expect the signer to reach out. Supporting both means Signet works with either onboarding style.

Flow

The client advertises nostrconnect://<client-pubkey>?relay=<wss>&secret=<s>&perms=<…>&name=<…>. To connect:

1. The user pastes the nostrconnect:// token into Signet.
2. The daemon parses it and connects to the named relay(s).
3. The daemon sends the connect acknowledgement to the client pubkey, echoing secret so the client can validate the link.
4. The requested perms are recorded against the connection (feeds the authorization policy).

Notes

• The nostr library already exposes the primitives — parseNostrConnectUri / buildNostrConnectUri and NostrConnectUri in src/nip46.zig. This is a daemon + GUI wiring task, not a library change.
• Daemon: add a "connect to a nostrconnect URI" entry point (parse → connect → send the connect-ack echoing the secret).
• GUI: a paste field / entry point for the token, surfaced alongside the existing bunker URL card.