feat(cli): add NIP-46 remote signing bunker support

[ldstreet]

Adds NIP-46 remote signing support to the Buzz CLI, enabling secure remote key management for production agent deployments.

Features

• buzz bunker connect — Connect to a remote signer (client mode)
• buzz bunker serve — Start a remote signer daemon (server mode)
• Full NIP-46 protocol support: connect, get_public_key, sign_event, nip44_encrypt, nip44_decrypt, ping, logout
• Client session tracking for security
• Configurable inactivity timeout (default 3600s, 0=infinite)
• Secret validation to prevent connection spoofing
• Auto-approve mode for development environments

Implementation

• Event kind 24133 (NIP-46 remote signing requests/responses)
• NIP-44 encryption for all payloads
• WebSocket communication via existing buzz-ws-client
• Bunker URL parsing: bunker://<pubkey>?relay=<url>&secret=<optional>
• Session-aware request rejection (clients must connect before signing)

Testing

• End-to-end tested against production NIP-46 signer
• All quality checks passing (fmt, clippy, unit tests)

Documentation

• CLI README updated with usage examples
• Security guidance added to README.md, SECURITY.md, and AGENTS.md
• Positioned as production-recommended approach for agent deployments

Use Cases

Recommended for:

• Production agents (keeps keys off runtime environment)
• CI/CD pipelines
• Multi-tenant agent platforms
• Compliance environments requiring hardware-backed keys

[tlongwell-block]

Thanks for submitting this, @ldstreet! This is a great idea and will get into Buzz soon (July/August). We're looking at a comprehensive setup that will work for both humans and agents, with conventional remote bunkers as well as live-hardware-signing. I really like the simplicity of the cli subcommand here and I think that will be incorporated into the remote signing implementation.

For anything security-sensitive, we typically have e2e testing and a formal/verified security model. The review for this PR included modeling and it ends up requiring a rework of the implementation to get them all green, so I'm going to close this for now in favor of the upcoming, wider remote signing work.