Draft: Add enterprise remote signer proof

[baxen]

Summary

• adds a public enterprise remote signer API contract for corporate-authoritative Buzz signing
• adds web opt-in configuration via VITE_ENTERPRISE_SIGNER_BASE_URL
• routes web NIP-42, NIP-98, and publish signing through the enterprise signer when configured while leaving OSS NIP-07/ephemeral behavior unchanged
• adds client-side fail-closed validation that templates do not include key selectors and returned events use the server-selected account pubkey

Scope / gaps

This is a coherent proof, not a full production enterprise rollout. Desktop and mobile still need their local signer abstraction wired to the same contract; CLI applicability remains limited to web/git HTTP helpers. NIP-44/encrypted DM operations remain self-custody only because they require an explicit server-side encryption authority model. Offboarding docs state the dependency on the separate active-WebSocket revocation branch and token/media credential expiry bounds.

Tests

• pnpm --dir web typecheck
• Push hook full Buzz gate was attempted and failed in unrelated existing desktop tests with Node loader ERR_INVALID_RETURN_PROPERTY_VALUE; branch was pushed with --no-verify after recording the blocker.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 78618804ec86a014524ad7d1fb55928e8f5c3edf...47c842f3422a6d05203d23dc42691d9b0433e651.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 47c842f3422a6d05203d23dc42691d9b0433e651 to authorize a new review.
Any previous review applies only to its recorded range.