refactor(audio-rooms): NestsClient API matches nostrnests reality (phase 2/3)

The Phase-1 interop harness exposed a substantial mismatch between our
production HTTP client and what the nostrnests reference server actually
exposes. This commit refactors `:nestsClient` and the wiring above it so
the production code path can talk to a real moq-auth + moq-relay.

| Aspect    | Before                                    | After (matches nostrnests/moq-auth/src/index.ts) |
|-----------|-------------------------------------------|--------------------------------------------------|
| Method    | GET                                       | POST                                             |
| URL       | `<base>/<roomId>`                         | `<base>/auth`                                    |
| Body      | none                                      | `{"namespace":"nests/<kind>:<host>:<roomId>","publish":bool}` |
| Response  | `{endpoint, token, codec, sample_rate}`   | `{token}` only                                   |
| Endpoint  | from response                             | from event's `endpoint` tag (passed via `NestsRoomConfig.endpoint`) |
| NIP-98    | bound to GET URL                          | bound to POST URL + body hash                    |

Type changes:
- New `NestsRoomConfig` data class bundling (authBaseUrl, endpoint,
  hostPubkey, roomId, kind). Built by the caller (UI / VM) from the
  NIP-53 kind 30312 event before invoking connectNests*.
- `NestsRoomConfig.moqNamespace()` produces the exact format
  moq-auth's NAMESPACE_REGEX expects: `nests/<kind>:<hex64>:<roomId>`.
- `NestsRoomInfo` deleted; replaced with a tiny `NestsTokenResponse(token)`
  matching the real response shape.
- `NestsClient.resolveRoom(serviceBase, roomId, signer): NestsRoomInfo`
  → `NestsClient.mintToken(room, publish, signer): String`. The
  publish flag drives the JWT claims (`get` for listeners, `put`
  for speakers).

Wire path:
- `OkHttpNestsClient` now POSTs `<authBase>/auth` with a JSON body
  and a NIP-98 Authorization header bound to (POST, url, body-hash).
- `connectNestsListener` / `connectNestsSpeaker` take `room:
  NestsRoomConfig` instead of split (serviceBase, roomId), pass
  `publish=false` / `publish=true` respectively, and use the room's
  `endpoint` (not a server-returned one) for the WebTransport
  connect. The minted JWT is the bearer token.
- `NestsListenerState.Connected` / `NestsSpeakerState.Connected` /
  `Broadcasting` carry the `room: NestsRoomConfig` instead of the old
  `roomInfo: NestsRoomInfo`.
- MoQ TrackNamespace for the room is now a single segment whose
  bytes are `room.moqNamespace()` — the simplest mapping to the
  relay's JWT claim check (`root: "<namespace>"`); Phase-3 round-trip
  test will confirm and adjust if the relay expects a multi-segment
  tuple.

Wiring above:
- `AudioRoomViewModel` constructor: replaces `(serviceBase, roomId)`
  with `(room: NestsRoomConfig)`. Connector seam interfaces
  (NestsListenerConnector, NestsSpeakerConnector) follow the same
  shape.
- `AudioRoomViewModelFactory` (Android) takes `room: NestsRoomConfig`.
- `AudioRoomActivity` adds `EXTRA_AUTH_BASE_URL`, `EXTRA_ENDPOINT`,
  `EXTRA_HOST_PUBKEY`, `EXTRA_KIND` Intent extras (was just service
  + roomId) and reconstructs `NestsRoomConfig` in onCreate. Drops
  `EXTRA_SERVICE_BASE`.
- `AudioRoomJoinCard` reads `event.endpoint()` + `event.pubKey` +
  `event.kind` in addition to `event.service()`; rooms missing any
  of those are silently un-joinable (the event author didn't host
  on a nests-compatible relay).
- `AudioRoomActivityContent` takes `room: NestsRoomConfig` in place
  of (serviceBase, roomId) and threads it down.

Phase-1 ping test rewired to use the production `OkHttpNestsClient`
end-to-end against the real `/auth`, asserting we get back a
3-segment JWT.

Existing in-process tests updated for the new types: NestsConnectTest,
NestsSpeakerTest, AudioRoomViewModelTest. NestsRoomInfoTest renamed to
NestsRoomConfigTest with new cases for the namespace formatter and the
auth-URL helper. All 80 in-process tests still green.

Phase 3 (next) will add the full round-trip interop test that runs
production `connectNestsListener` + `connectNestsSpeaker` through the
real moq-relay — that's where MoQ wire-format assumptions (draft
revision, OBJECT_DATAGRAM layout, namespace tuple shape) get verified
or get followup audit findings.

nestsClient/src/jvmTest/kotlin/com/vitorpamplona/nestsclient/interop/NostrNestsAuthInteropTest.kt

@@ -20,86 +20,52 @@
  */
 package com.vitorpamplona.nestsclient.interop
 
-import com.vitorpamplona.nestsclient.NestsAuth
+import com.vitorpamplona.nestsclient.NestsRoomConfig
+import com.vitorpamplona.nestsclient.OkHttpNestsClient
 import com.vitorpamplona.quartz.nip01Core.crypto.KeyPair
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSignerInternal
 import kotlinx.coroutines.runBlocking
-import okhttp3.MediaType.Companion.toMediaType
-import okhttp3.OkHttpClient
-import okhttp3.Request
-import okhttp3.RequestBody.Companion.toRequestBody
 import org.junit.AfterClass
 import org.junit.BeforeClass
 import org.junit.Test
-import kotlin.test.assertEquals
 import kotlin.test.assertTrue
 
 /**
  * Phase-1 interop smoke test. Brings up a real nostrnests stack (auth
- * sidecar + MoQ relay + strfry) via Docker Compose, then exercises the
- * `/auth` endpoint with a hand-rolled NIP-98 request that matches what
- * the server actually expects.
- *
- * Doesn't yet use [com.vitorpamplona.nestsclient.NestsClient] —
- * `OkHttpNestsClient`'s wire shape (GET `<base>/<roomId>` with no body,
- * expecting `{endpoint, token}` back) doesn't match the real server
- * (POST `<base>/auth` with `{namespace, publish}` body, returning just
- * `{token}`). Phase 2 of this audit refactors the production client to
- * match; until then this test documents the divergence on the wire.
+ * sidecar + MoQ relay + strfry) via Docker Compose, then drives the
+ * production [OkHttpNestsClient] against the real `/auth` endpoint to
+ * mint a JWT. Validates the wire format (POST `<base>/auth` with
+ * `{namespace, publish}` body + NIP-98 Authorization header, returning
+ * `{token}`) end-to-end.
  *
  * Skipped by default — set `-DnestsInterop=true` to enable.
  */
 class NostrNestsAuthInteropTest {
     @Test
-    fun auth_endpoint_returns_jwt_for_a_well_formed_nip98_request() =
+    fun production_OkHttpNestsClient_mints_a_jwt_against_real_moq_auth() =
         runBlocking {
             NostrNestsHarness.assumeNestsInterop()
             val harness = harnessOrNull ?: return@runBlocking
 
-            val keys = KeyPair()
-            val signer = NostrSignerInternal(keys)
-            val pubkeyHex = signer.pubKey
-
-            val authUrl = "${harness.authBaseUrl}/auth"
-            val roomId = "interop-${System.currentTimeMillis()}"
-            val namespace = "nests/30312:$pubkeyHex:$roomId"
-            val body = """{"namespace":"$namespace","publish":true}"""
-
-            val authHeader =
-                NestsAuth.header(
-                    signer = signer,
-                    url = authUrl,
-                    method = "POST",
-                    payload = body.toByteArray(),
+            val signer = NostrSignerInternal(KeyPair())
+            val client = OkHttpNestsClient()
+            val room =
+                NestsRoomConfig(
+                    authBaseUrl = harness.authBaseUrl,
+                    endpoint = harness.moqEndpoint,
+                    hostPubkey = signer.pubKey,
+                    roomId = "interop-${System.currentTimeMillis()}",
                 )
 
-            val request =
-                Request
-                    .Builder()
-                    .url(authUrl)
-                    .post(body.toRequestBody("application/json".toMediaType()))
-                    .header("Authorization", authHeader)
-                    .build()
+            val token = client.mintToken(room = room, publish = true, signer = signer)
 
-            val (status, responseBody) =
-                http.newCall(request).execute().use { response ->
-                    response.code to (response.body.string())
-                }
-
-            assertEquals(
-                200,
-                status,
-                "POST /auth should return 200 with a valid NIP-98 + namespace; got $status: $responseBody",
-            )
-            // moq-auth's response is `{"token":"<jwt>"}` per its index.ts.
-            assertTrue(
-                responseBody.contains("\"token\":\""),
-                "Expected JWT in `token` field, got: $responseBody",
-            )
+            // moq-auth signs JWS tokens with three base64url-encoded
+            // segments separated by dots.
+            assertTrue(token.count { it == '.' } == 2, "Expected JWT (3 segments), got: $token")
+            assertTrue(token.isNotBlank(), "JWT must be non-empty")
         }
 
     companion object {
-        private val http = OkHttpClient()
         private var harnessOrNull: NostrNestsHarness? = null
 
         @BeforeClass