Close the metadata gap: the outer kind-4497 envelope was signed with the
sender's real key, so a coordinator/relay could see exactly who was talking.
- buildEnvelope now signs each envelope with a fresh ephemeral key (NIP-59
style) — the coordinator never learns the sender.
- Authorship moves inside the ciphertext: a new v2 sealed payload
(`nip44-group-v2`) carries a fully-signed inner author-proof event (kind 4498)
bound to the crew via an `a` tag. openGroupMessage verifies the signature,
author, content match, and group binding — so authorship stays unforgeable and
a proof can't be replayed into another crew.
- Transport trusts the verified v2 proof and surfaces the real sender; legacy
v1 envelopes remain readable (outer-key binding) for back-compat.
- NIP.md updated with the v2 format + an honest note on the residual
verbatim-replay caveat (full replay/forward-secrecy hardening lands with MLS).
Scope decision: kept to crew chat only. Regular 1:1/group DMs already use NIP-17
gift wrap (ephemeral keys, sealed per recipient) and have no coordinator, so
they need no change and stay idiot-proof.
Co-authored-by: shakespeare.diy <assistant@shakespeare.diy>
e843bd526a