feat: fix NIP-07 signing to use node Nostr key, add test script

Added node.nostr-sign RPC that uses the node-level Nostr key (matching
getPublicKey), fixing pubkey mismatch where identity.nostr-sign used a
different key. Updated appLauncher to call node.nostr-sign. Added
nostr_sign_hash() to nostr_discovery.rs. Created test-nip07.sh with
11 automated checks (INSTALL-02).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/archipelago/src/nostr_discovery.rs

@@ -200,6 +200,20 @@ pub async fn get_nostr_pubkey(identity_dir: &Path) -> Result<String> {
     Ok(keys.public_key().to_hex())
 }
 
+/// Sign a 32-byte hash with the node's Nostr Schnorr key.
+pub async fn nostr_sign_hash(identity_dir: &Path, hash_hex: &str) -> Result<String> {
+    let keys = load_or_create_nostr_keys(identity_dir).await?;
+    let hash_bytes = hex::decode(hash_hex).context("Invalid hash hex")?;
+    if hash_bytes.len() != 32 {
+        anyhow::bail!("Hash must be 32 bytes");
+    }
+    let message = nostr_sdk::secp256k1::Message::from_digest(
+        hash_bytes.try_into().map_err(|_| anyhow::anyhow!("Invalid hash length"))?,
+    );
+    let sig = keys.sign_schnorr(&message);
+    Ok(sig.to_string())
+}
+
 /// Verify that our node's Nostr discovery data was revoked on the legacy relays.
 /// Queries relays for our pubkey's kind 30078 events; if latest has empty content, revocation succeeded.
 #[derive(Debug, serde::Serialize, serde::Deserialize)]