refactor(audio-rooms): NestsClient API matches nostrnests reality (phase 2/3)

The Phase-1 interop harness exposed a substantial mismatch between our
production HTTP client and what the nostrnests reference server actually
exposes. This commit refactors `:nestsClient` and the wiring above it so
the production code path can talk to a real moq-auth + moq-relay.

| Aspect    | Before                                    | After (matches nostrnests/moq-auth/src/index.ts) |
|-----------|-------------------------------------------|--------------------------------------------------|
| Method    | GET                                       | POST                                             |
| URL       | `<base>/<roomId>`                         | `<base>/auth`                                    |
| Body      | none                                      | `{"namespace":"nests/<kind>:<host>:<roomId>","publish":bool}` |
| Response  | `{endpoint, token, codec, sample_rate}`   | `{token}` only                                   |
| Endpoint  | from response                             | from event's `endpoint` tag (passed via `NestsRoomConfig.endpoint`) |
| NIP-98    | bound to GET URL                          | bound to POST URL + body hash                    |

Type changes:
- New `NestsRoomConfig` data class bundling (authBaseUrl, endpoint,
  hostPubkey, roomId, kind). Built by the caller (UI / VM) from the
  NIP-53 kind 30312 event before invoking connectNests*.
- `NestsRoomConfig.moqNamespace()` produces the exact format
  moq-auth's NAMESPACE_REGEX expects: `nests/<kind>:<hex64>:<roomId>`.
- `NestsRoomInfo` deleted; replaced with a tiny `NestsTokenResponse(token)`
  matching the real response shape.
- `NestsClient.resolveRoom(serviceBase, roomId, signer): NestsRoomInfo`
  → `NestsClient.mintToken(room, publish, signer): String`. The
  publish flag drives the JWT claims (`get` for listeners, `put`
  for speakers).

Wire path:
- `OkHttpNestsClient` now POSTs `<authBase>/auth` with a JSON body
  and a NIP-98 Authorization header bound to (POST, url, body-hash).
- `connectNestsListener` / `connectNestsSpeaker` take `room:
  NestsRoomConfig` instead of split (serviceBase, roomId), pass
  `publish=false` / `publish=true` respectively, and use the room's
  `endpoint` (not a server-returned one) for the WebTransport
  connect. The minted JWT is the bearer token.
- `NestsListenerState.Connected` / `NestsSpeakerState.Connected` /
  `Broadcasting` carry the `room: NestsRoomConfig` instead of the old
  `roomInfo: NestsRoomInfo`.
- MoQ TrackNamespace for the room is now a single segment whose
  bytes are `room.moqNamespace()` — the simplest mapping to the
  relay's JWT claim check (`root: "<namespace>"`); Phase-3 round-trip
  test will confirm and adjust if the relay expects a multi-segment
  tuple.

Wiring above:
- `AudioRoomViewModel` constructor: replaces `(serviceBase, roomId)`
  with `(room: NestsRoomConfig)`. Connector seam interfaces
  (NestsListenerConnector, NestsSpeakerConnector) follow the same
  shape.
- `AudioRoomViewModelFactory` (Android) takes `room: NestsRoomConfig`.
- `AudioRoomActivity` adds `EXTRA_AUTH_BASE_URL`, `EXTRA_ENDPOINT`,
  `EXTRA_HOST_PUBKEY`, `EXTRA_KIND` Intent extras (was just service
  + roomId) and reconstructs `NestsRoomConfig` in onCreate. Drops
  `EXTRA_SERVICE_BASE`.
- `AudioRoomJoinCard` reads `event.endpoint()` + `event.pubKey` +
  `event.kind` in addition to `event.service()`; rooms missing any
  of those are silently un-joinable (the event author didn't host
  on a nests-compatible relay).
- `AudioRoomActivityContent` takes `room: NestsRoomConfig` in place
  of (serviceBase, roomId) and threads it down.

Phase-1 ping test rewired to use the production `OkHttpNestsClient`
end-to-end against the real `/auth`, asserting we get back a
3-segment JWT.

Existing in-process tests updated for the new types: NestsConnectTest,
NestsSpeakerTest, AudioRoomViewModelTest. NestsRoomInfoTest renamed to
NestsRoomConfigTest with new cases for the namespace formatter and the
auth-URL helper. All 80 in-process tests still green.

Phase 3 (next) will add the full round-trip interop test that runs
production `connectNestsListener` + `connectNestsSpeaker` through the
real moq-relay — that's where MoQ wire-format assumptions (draft
revision, OBJECT_DATAGRAM layout, namespace tuple shape) get verified
or get followup audit findings.

nestsClient/src/jvmAndroid/kotlin/com/vitorpamplona/nestsclient/OkHttpNestsClient.kt

@@ -23,8 +23,10 @@ package com.vitorpamplona.nestsclient
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
+import okhttp3.MediaType.Companion.toMediaType
 import okhttp3.OkHttpClient
 import okhttp3.Request
+import okhttp3.RequestBody.Companion.toRequestBody
 import java.io.IOException
 
 /**
@@ -35,19 +37,35 @@ import java.io.IOException
 class OkHttpNestsClient(
     private val http: OkHttpClient = OkHttpClient(),
 ) : NestsClient {
-    override suspend fun resolveRoom(
-        serviceBase: String,
-        roomId: String,
+    override suspend fun mintToken(
+        room: NestsRoomConfig,
+        publish: Boolean,
         signer: NostrSigner,
-    ): NestsRoomInfo {
-        val url = nestsRoomInfoUrl(serviceBase, roomId)
-        val authHeader = NestsAuth.header(signer = signer, url = url, method = "GET")
+    ): String {
+        val url = nestsAuthUrl(room.authBaseUrl)
+        val bodyJson =
+            buildString {
+                append('{')
+                append("\"namespace\":\"").append(room.moqNamespace()).append('"')
+                append(",\"publish\":").append(publish)
+                append('}')
+            }
+        val bodyBytes = bodyJson.encodeToByteArray()
+        // NIP-98 binds the signed event to (url, method, body-hash) so the
+        // server can reject a token replayed against a different request.
+        val authHeader =
+            NestsAuth.header(
+                signer = signer,
+                url = url,
+                method = "POST",
+                payload = bodyBytes,
+            )
 
         val request =
             Request
                 .Builder()
                 .url(url)
-                .get()
+                .post(bodyJson.toRequestBody(JSON_MEDIA_TYPE))
                 .header("Authorization", authHeader)
                 .header("Accept", "application/json")
                 .build()
@@ -59,12 +77,12 @@ class OkHttpNestsClient(
                     val body = response.body.string()
                     if (!response.isSuccessful) {
                         throw NestsException(
-                            "nests server returned ${response.code} for $url",
+                            "nests server returned ${response.code} for $url: $body",
                             status = response.code,
                         )
                     }
                     try {
-                        NestsRoomInfo.parse(body)
+                        NestsTokenResponse.parse(body).token
                     } catch (e: IOException) {
                         throw NestsException("Malformed nests response from $url", e)
                     } catch (e: IllegalArgumentException) {
@@ -75,4 +93,8 @@ class OkHttpNestsClient(
                 }
         }
     }
+
+    private companion object {
+        private val JSON_MEDIA_TYPE = "application/json".toMediaType()
+    }
 }