security(TASK-8): fix 8 pentest findings — C1/C3/H1/M1/M2/L2

CRITICAL:
- C1: /lnd-connect-info now requires session auth, CORS wildcard removed
- C3: DEV_MODE removed from production service file (dev override only)

HIGH:
- H1: node-message endpoint now verifies ed25519 signatures when
  provided, logs warning for unsigned messages

MEDIUM:
- M1: content.add rejects filenames containing ".." (path traversal)
- M2: NIP-07 postMessage responses use specific origin instead of '*'

LOW:
- L2: Onion validation now enforces strict v3 format (56 base32 chars
  + ".onion", exactly 62 chars, no colons)

Previously fixed: C2 (RPC creds generated per-install from secrets)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/stores/appLauncher.ts

@@ -234,7 +234,7 @@ export const useAppLauncherStore = defineStore('appLauncher', () => {
             const remember = await requestConsent(title.value || 'App', 'signEvent', eventKind, content)
             if (remember) saveApprovedOrigin(origin)
           } catch {
-            source.postMessage({ type: 'nostr-response', id, error: 'User denied signing request' }, '*')
+            source.postMessage({ type: 'nostr-response', id, error: 'User denied signing request' }, origin || '*')
             return
           }
         }
@@ -278,10 +278,10 @@ export const useAppLauncherStore = defineStore('appLauncher', () => {
       } else {
         throw new Error(`Unsupported NIP-07 method: ${method}`)
       }
-      source.postMessage({ type: 'nostr-response', id, result }, '*')
+      source.postMessage({ type: 'nostr-response', id, result }, origin || '*')
     } catch (err) {
       const message = err instanceof Error ? err.message : 'Unknown error'
-      source.postMessage({ type: 'nostr-response', id, error: message }, '*')
+      source.postMessage({ type: 'nostr-response', id, error: message }, origin || '*')
     }
   }