Add NIP-46 remote signing for kind:30618 state events

- nip46.rs: full NIP-46 client with session management, NIP-04 encrypted
  relay-based communication, oneshot response awaiting
- db.rs: nip46_sessions table, upsert/get methods
- config.rs: Nip46Config with relays + signing_timeout_secs
- git_mirror.rs: builds unsigned kind:30618 state event from bare repo refs,
  signs via NIP-46 before push, publishes to target server relay
- http_health.rs: exposes NIP-46 session status in health endpoint
- main.rs: wires NIP-46 client into daemon startup, passes to mirror_cycle

1 files changed, 18 insertions, 0 deletions

diff --git a/src/http_health.rs b/src/http_health.rs
index 0cdfeb5..d3f5df2 100644
--- a/src/http_health.rs
+++ b/src/http_health.rs
@@ -12,6 +12,7 @@ pub struct HealthState {
     pub cycle_count: watch::Receiver<u64>,
     pub last_cycle_ok: watch::Receiver<bool>,
     pub db_path: String,
+    pub nip46_client: Option<Arc<crate::nip46::Nip46Client>>,
 }
 
 pub async fn start_health_server(port: u16, state: Arc<HealthState>) -> anyhow::Result<()> {
@@ -31,10 +32,27 @@ async fn health_handler(State(state): State<Arc<HealthState>>) -> Json<Value> {
     let cycle_count = *state.cycle_count.borrow();
     let last_ok = *state.last_cycle_ok.borrow();
 
+    let nip46_sessions = if let Some(ref client) = state.nip46_client {
+        let statuses = client.get_status().await;
+        statuses
+            .into_iter()
+            .map(|s| {
+                json!({
+                    "npub": s.npub,
+                    "connected": s.connected,
+                    "pairing_uri": s.pairing_uri,
+                })
+            })
+            .collect::<Vec<_>>()
+    } else {
+        vec![]
+    };
+
     Json(json!({
         "status": if last_ok || cycle_count == 0 { "ok" } else { "degraded" },
         "uptime_secs": uptime.as_secs(),
         "cycle_count": cycle_count,
         "last_cycle_ok": last_ok,
+        "nip46": nip46_sessions,
     }))
 }