feat(desktop): locally stored NIP-49 encrypted key backup

[tlongwell-block]

Summary

Adds a locally stored NIP-49 encrypted key backup (ncryptsec) to the desktop app, per the plan reviewed in buzz-development (Rev 3, approved 9/10 by Wren; implementation also reviewed and approved 9/10).

Two-artifact design — canonical bytes originate entirely in Rust:

• create_ncryptsec_backup runs under the identity_mutation lock: encrypt → decrypt-verify against the live pubkey → atomic 0o600 write to {app_data_dir}/identity.ncryptsec → reread/byte-compare → return the exact persisted bytes. The frontend never re-derives or re-encrypts.
• save_ncryptsec_copy writes a portable copy via the save dialog (parse-gated, secret-file semantics) and never mutates canonical state.
• generate_backup_passphrase: 6 words from the EFF short wordlist via OsRng (custom passphrases min 12 chars).
• Import accepts ncryptsec1 with optional password; the raw-nsec path is untouched. Different-pubkey import and sign-out wipe the app-managed backup (post-commit, best-effort — a failed import can never destroy the still-live identity's backup; regression-tested).

Never-relay guarantee (egress guard + tripwires):

• egress_guard.rs fail-closed at all 8 /events submission boundaries (relay submit funnel, 3× relay.rs, huddle STT, both engram submitters, native WS choke point), rejecting ncryptsec1/NCRYPTSEC1 in text and binary frames. Scope is deliberately ncryptsec-only: pairing intentionally carries raw nsec inside its encrypted session.
• Site-granular /events inventory tripwire: per-file (/events count, guard-call count) pairs; unlisted files expect zero. Mutation-style tests prove a ninth site in an existing file, a removed guard, and a new unlisted file all fail the scan.
• ncryptsec source-allowlist scans in both trees (Rust + TS).

Frontend: onboarding BackupStep is encrypted-by-default — the default path never invokes get_nsec (e2e asserts the command log). Raw-nsec export stays behind an explicit click with prior semantics. Shared EncryptedBackupCreator powers onboarding + a new settings row; the import form auto-switches to encrypted mode on ncryptsec1 paste (case-insensitive HRP).

Open product call for @tlongwell-block: onboarding default is encrypted in this PR; flipping to raw-default is a small change either way (documented in the plan).

Review history: plan Rev 3 and the implementation were both iterated with Wren to 9/10 (two blockers from round 1 — import ordering, inventory granularity — plus an uppercase-bech32 hardening gap, all fixed in dde37183e). Thread: buzz-development.

Related issue

Follow-up to the direction explored in #385 (NIP-PB, closed) — this ships local NIP-49 (the standard) instead of a new NIP. No open duplicate found.

Testing

All at exactly dde37183e (same shell, HEAD verified):

• cargo test — 1680 passed / 0 failed / 14 ignored (includes a deliberate ~70s log_n-18 NIP-49 round trip, spec vector, wrong-password, NFKC, uppercase-vector decrypt, injection test per egress boundary, inventory mutation tests, import-ordering regression tests)
• cargo clippy --all-targets -- -D warnings — clean; cargo fmt --check — clean
• pnpm typecheck — clean; JS unit suite 3529/3529; biome (repo-pinned 2.4.16) clean
• Playwright onboarding-backup / onboarding / onboarding-agent-defaults / profile-nsec-reveal — 86 passed, 1 known avatar-reservation flake (passed on rerun; untouched by this diff). passThroughBackupStep now exercises the encrypted default, so every downstream onboarding spec covers the new path.
• Note: browser e2e fakes the crypto via the mock bridge (fixed spec-vector blob); decryption correctness is proven in the Rust tests.

Latest onboarding integration

The current head adds an additive IdentityInfo.storage field (ephemeral, system-keyring, local-file, or environment) so onboarding can accurately explain where the active identity is protected. It surfaces storage metadata only—never key material—and leaves the existing lost/keyring-locked recovery behavior intact.

[tlongwell-block]

Freshened vs main + spec naming pass (channel buzz-nip49-password-backup):

• 7a6a2cda5 — merge main into the branch (70 commits behind; conflicts none, lockfile/onboarding churn absorbed cleanly).
• 51ea1b18f — settings row renamed "Password Backup" per Tyler's spec; description now says "password" instead of "passphrase"; two doc comments updated. No behavior change, test ids unchanged.

Per Wren's ruling in-channel: no artifact-model reshape — the flow (type password → encrypt → OS save dialog via save_ncryptsec_copy) already satisfies the spec; the app-managed canonical copy stays until Tyler explicitly rules one-artifact.

Verified at exact 51ea1b18f (same shell, git rev-parse HEAD confirmed):

• desktop TS: 3735/3735 pass; pnpm typecheck + biome pnpm check clean
• desktop tauri: 1858 pass / 0 fail / 14 ignored (pre-existing compiled-flag ignores; NIP-49 suite fully in the run incl. round_trip_at_production_cost at log_n 18)
• just test-unit (buzz-core, buzz-auth, buzz-db --lib, buzz-conformance, buzz-push-gateway): all pass
• pre-push lefthook full matrix green (branch-skew, desktop-check/test, mobile-test, rust-tests, desktop-tauri-test)

Max's independent clean-room battery + live manual pass runs next at this SHA.

[tlongwell-block]

Blocker fix: saved .ncryptsec backups are now importable from file (found by Max's clean-room pass at 51ea1b18f):

• The file input accepted only .key,text/plain — macOS greyed out the identity.ncryptsec this PR's own save dialog emits.
• The first-launch/wiped spotlight variant rendered no file input at all, so the exact wipe → import-from-file recovery path was paste-only.

Fix (72f00afa8): accept .ncryptsec in the shared hidden file input, hoist it out of the default-variant branch, add an "Import from a file" button to the spotlight variant wired to the same picker. Default-variant drop zone unchanged. New e2e covers the spotlight file path end to end (file → encrypted badge → passphrase → decrypt-and-continue), asserting the accept attribute explicitly since setInputFiles bypasses it.

Verified at exact 72f00afa8 (same shell): desktop TS 3735/3735, typecheck + biome clean, Playwright integration run for onboarding/identity-lost/backup/key-import specs 75 passed (1 flaky retry in an unrelated avatar test, passes on retry), pre-push lefthook lanes green. No Rust surface touched.

[tlongwell-block]

CI fix receipt — head 855d25ef3a138a8b28403d82c0bcda9ff3529392

The two red Desktop Smoke shards at 72f00afa8 (run 30366893036) were a real semantic merge conflict, not flake: the main merge brought in two smoke specs written against the old raw-key backup step, while this branch makes onboarding encrypted-by-default (Next gated on backup creation; raw nsec behind an explicit backup-show-raw-key click).

• harness-management.spec.ts:676 (More-harnesses nav, from feat(desktop): redesign agent runtime settings #3093) clicked Next on the backup page without creating a backup → now routes through the existing passThroughBackupStep helper (commit d7e52ea1a, test-only).
• onboarding-docked-cta-screenshots.spec.ts:63 clicked nsec-reveal-toggle without first showing the raw key → now clicks backup-show-raw-key first, which is also the raw-key card the screenshot exists to capture.

Also merged origin/main (one commit: 0.5.0 release version bump, 855d25ef3's merge parent 4a977c588) — the pre-push branch-skew guard correctly refused to push a tree CI would never test.

Verified locally at exact head 855d25ef3 in the same shell: both touched smoke specs 18/18, desktop unit 3735/3735, typecheck + Biome clean, full lefthook pre-push matrix green (incl. desktop-tauri-test).