keep-frost-net: abstract co-signing transport behind a trait (decouple from nostr_sdk)

[kwsantiago]

Context

keep-frost-net is wired directly to nostr_sdk throughout the signing path with no transport seam. This blocks deployments that cannot or will not use public Nostr relays (private-relay / centralized-broker / enterprise setups), and is the highest-leverage architectural change for using Keep as an open foundation under a platform that owns its own transport.

Current coupling points

• nostr_sdk::PublicKey is the fundamental peer identity (keep-frost-net/src/peer.rs, descriptor_session.rs)
• Messages are Nostr events, kind 27245, NIP-44 encrypted (keep-frost-net/src/protocol.rs)
• KfpNode instantiates a RelayPool directly rather than accepting a transport (keep-frost-net/src/node/)
• nostr_sdk::Timestamp used for event ordering (protocol.rs)

There is currently no trait Transport / trait Relay abstraction (confirmed by grep).

Proposed direction

Design-first. Introduce a transport trait roughly along the lines of:

trait Transport {
    async fn publish(&self, event: TransportMessage) -> Result<()>;
    async fn subscribe(&self, filter: SubscriptionFilter) -> Result<MessageStream>;
}

• Extract message serialization from the Nostr event schema to a transport-neutral form.
• Make KfpNode generic over / hold a Box<dyn Transport> instead of a hardcoded RelayPool.
• Keep the Nostr implementation as the default NostrTransport.
• Peer identity abstraction (Nostr pubkey vs other) is the hardest sub-problem and should be scoped explicitly in the design.

Scope / risk

Non-trivial refactor that touches the signing path; high care required to avoid introducing signing-coordination bugs. Recommend landing as: (1) design doc + trait, (2) Nostr impl behind the trait with no behavior change, (3) optional alternate transport later.

Out of scope

No new transport implementations are required by this issue — only the seam and the Nostr impl behind it.