feat(sign-in): a recovery phrase or an nsec, recognised, confirmed, then written

Phase 4 of docs/nsec-sign-in.md. SignInToProfileScreen stops being a sentence
about alpha testing and becomes the screen: one field, two things it accepts,
and the npub it signs as shown before anything is written.

One field, because a user does not choose an input type -- they paste what they
have -- and the two shapes are unambiguous: words have spaces, keys do not.
CredentialParser is that decision as a pure function. Words go through
MnemonicCode.validate and derive their NIP-06 key; an nsec, a nostr:-prefixed
nsec or sixty-four hex characters decode to a PrivateKey and must pass
isValid(). The two shapes a reasonable person might paste and that cannot
work are refused by name rather than lumped in with garbage: an npub is
PublicKeyOnly (nothing here can sign with it), an ncryptsec is EncryptedKey
(NIP-49; a follow-on). Words are not lower-cased -- the wordlist already is,
and a capital is a paste artefact worth showing rather than silently fixing.

Problems with the input stay on the field, as supporting text, while the
prompt is still showing; problems after confirming -- the key was already
here, the write failed -- are a state of the screen, through ErrorState with
a retry back to the field. Four states, wrapped in ScreenStateTransition.

Confirm shows the npub in full, in monospace, and which kind was recognised,
with the one consequence that differs: a recovery phrase also restores the
wallet, a bare key comes with none. The secret itself is never echoed.

SignInToProfileViewModel.commit is the effect, and its order is the point.
The secret is written to its store first -- IdentityWriter.writeNostrKey for
an nsec, SovereignWalletViewModel.writeSeed (isRestoringWallet = true) for a
phrase, both injected as functions so the commit can be driven without a key
store -- and only on success is the placeholder account planted with
nostrRepository.signInToProfile. The placeholder before the write would send
the user to fetch a profile they can never sign for; the write before the
placeholder is what the nav host then does. Both writers already refuse a
duplicate by nostr public key, so a wallet's own nostr secret pasted as an
nsec is AlreadyOnThisDevice, and so is a seed whose key is already here bare.

The nav host wires the route with the same tail the create flow uses after
writeSeed: re-list identities, select the new one, go to startup with the form
popped, so back does not return to a field holding a secret. Startup finds
the identity, activates it, and NavigationViewModel takes it from the
placeholder to UnqueuedProfileSynchronization -- which Phase 3 made safe from
both entrances.

Strings: nineteen new, sentence case, including the refusals as sentences
that say what to do instead. The six Torch-era sign-in strings nothing
referenced any more are gone, and the landing caption no longer promises a
remote signer this does not deliver.

Tests. CredentialParserJvmTest is every row of the table in and out, all
three spellings of NIP-06's vector -- words, nsec, hex, with and without the
nostr: prefix, in either case -- asserted to land on the same public key,
which is the equality the duplicate check rests on; and each refusal by name.
SignInToProfileViewModelJvmTest records the effects of a commit and asserts
their order and count: write then plant for both kinds, and no planting after
a refusal or a throw.

Verified with :composeApp:compileDebugKotlinAndroid, :composeApp:jvmTest (885
tests) and :composeApp:m3Audit, which found no spacing literal or title-case
string in the new screen.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Pulled-From: curated/curated@220616019e

composeApp/src/commonMain/composeResources/values/strings.xml

@@ -91,7 +91,6 @@
     <string name="encrypt_and_back_your_recovery_information">Encrypt and back your recovery information up to your Google Drive or iCloud.</string>
     <string name="enter_the_name_you_want_to_use_for_your">Enter the name you want to use for your group</string>
     <string name="enter_the_name_you_want_to_use_for_your_2">Enter the name you want to use for your profile</string>
-    <string name="enter_the_nsec_or_npub_read_only_that_you">Enter the nsec or npub (read only) that you want to sign in as</string>
     <string name="enter_the_translation_for_this_chunk">Enter the translation for this chunk</string>
     <string name="events_are_indexed_so_that_we_can_deliver_a">Events are indexed so that we can deliver a premium local first experience.</string>
     <string name="everything_else">Everything else</string>
@@ -168,7 +167,6 @@
     <string name="no_versions">No versions.</string>
     <string name="not_now">Not now</string>
     <string name="nothing_was_created_and_no_key_exists_it_is">Nothing was created and no key exists. It is safe to run it again.</string>
-    <string name="nsec_npub_nip_05_static_address">nsec, npub, nip-05 (static address)</string>
     <string name="open_chat">Open chat</string>
     <string name="original">Original</string>
     <string name="original_text">Original text</string>
@@ -228,10 +226,6 @@
     <string name="this_device_does_not_hold_the_event">This device holds the group's reading of this, but not the signed event itself. Nothing here can be checked against a signature.</string>
     <string name="sign">Sign</string>
     <string name="sign_in">Sign in</string>
-    <string name="sign_in_is_not_yet_available_while_mantra_is">Sign in is not yet available while Mantra is in alpha testing.</string>
-    <string name="sign_in_to_nsec">Sign in to nsec</string>
-    <string name="sign_in_to_torch_via_nsec_or_remote_signer">Sign in to Mantra via nsec, or remote signer</string>
-    <string name="sign_in_with_an_npub">Sign in with an npub</string>
     <string name="sign_out">Sign out</string>
     <string name="sign_with_the_group_s_key">Sign with the group's key</string>
     <string name="signed_their_part">Signed their part</string>
@@ -576,4 +570,24 @@
     <string name="content_must_be_text">Content must be text.</string>
     <string name="the_content_is_not_a_profile">The content isn't a profile. A kind 0 carries a JSON object of profile fields.</string>
     <string name="this_schema_cannot_be_signed_as_it_is">This schema can't be signed as it is:</string>
+    <!-- Sign in: docs/nsec-sign-in.md, phase 4. -->
+    <string name="a_password_protected_key_ncryptsec_is_not">A password-protected key (ncryptsec) is not supported yet. Decrypt it in the app it came from and paste the nsec.</string>
+    <string name="an_npub_is_a_public_key_mantra_needs_the">An npub is a public key. Mantra needs the secret key, the nsec, to sign as you.</string>
+    <string name="enter_a_recovery_phrase_or_an_nsec_to_sign_in">Enter a recovery phrase or an nsec to sign in.</string>
+    <string name="paste">Paste</string>
+    <string name="recognised_as_a_nostr_secret_key_no_wallet">Recognised as a nostr secret key. No wallet comes with it.</string>
+    <string name="recognised_as_a_recovery_phrase_it_also">Recognised as a recovery phrase. It also restores the wallet.</string>
+    <string name="recovery_phrase_or_nsec">Recovery phrase or nsec</string>
+    <string name="sign_in_with_a_recovery_phrase_or_an_nsec">Sign in with a recovery phrase or an nsec</string>
+    <string name="signed_in">Signed in</string>
+    <string name="signing_you_in">Signing you in…</string>
+    <string name="that_is_not_a_recovery_phrase_or_a_nostr_key">That is not a recovery phrase or a nostr key.</string>
+    <string name="that_nostr_secret_key_is_not_valid">That nostr secret key is not valid.</string>
+    <string name="that_recovery_phrase_is_not_valid_check">That recovery phrase is not valid. Check each word and the order.</string>
+    <string name="the_key_could_not_be_saved_on_this_device">The key could not be saved on this device.</string>
+    <string name="the_words_or_the_key_never_leave_this_device">Whatever you paste stays on this device. Mantra checks it, shows you the profile it opens, and writes nothing until you confirm.</string>
+    <string name="this_key_is_already_on_this_device">This key is already on this device.</string>
+    <string name="twelve_words_or_nsec1">Twelve words, or nsec1…</string>
+    <string name="use_a_different_key">Use a different key</string>
+    <string name="you_are_signing_in_as">You are signing in as</string>
 </resources>