Add NIP-46 remote signing for kind:30618 state events

- nip46.rs: full NIP-46 client with session management, NIP-04 encrypted
  relay-based communication, oneshot response awaiting
- db.rs: nip46_sessions table, upsert/get methods
- config.rs: Nip46Config with relays + signing_timeout_secs
- git_mirror.rs: builds unsigned kind:30618 state event from bare repo refs,
  signs via NIP-46 before push, publishes to target server relay
- http_health.rs: exposes NIP-46 session status in health endpoint
- main.rs: wires NIP-46 client into daemon startup, passes to mirror_cycle

1 files changed, 14 insertions, 0 deletions

diff --git a/src/config.rs b/src/config.rs
index 037deb2..4117507 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -9,6 +9,7 @@ pub struct AppConfig {
     pub servers: ServersConfig,
     pub storage: StorageConfig,
     pub signing: Option<SigningConfig>,
+    pub nip46: Option<Nip46Config>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -60,11 +61,23 @@ pub struct SigningConfig {
     pub key_file: PathBuf,
 }
 
+#[derive(Debug, Deserialize)]
+pub struct Nip46Config {
+    pub relays: Vec<String>,
+    #[serde(default = "default_signing_timeout")]
+    pub signing_timeout_secs: u64,
+}
+
+fn default_signing_timeout() -> u64 {
+    604800
+}
+
 pub struct ResolvedConfig {
     pub discovery: DiscoveryConfig,
     pub servers: ServersConfig,
     pub storage: StorageConfig,
     pub signing: Option<SigningConfig>,
+    pub nip46: Option<Nip46Config>,
     pub npubs: Vec<PublicKey>,
 }
 
@@ -89,6 +102,7 @@ impl ResolvedConfig {
             servers: app.servers,
             storage: app.storage,
             signing: app.signing,
+            nip46: app.nip46,
             npubs,
         })
     }