chore(deps): upgrade to Noble 2.0, vitest 4, nostr-crypto-utils 0.6.0

- @noble/curves ^1.9.7 → ^2.0.1, @noble/hashes ^1.8.0 → ^2.0.1
- Remove standalone @noble/secp256k1 (unused directly)
- vitest ^3.2.4 → ^4.0.18, @vitest/coverage-v8 ^3.2.4 → ^4.0.18
- nostr-crypto-utils ^0.5.1 → ^0.6.0
- Fix browser build: externalize jsonwebtoken, alias nostr-crypto-utils to CJS
- 8/8 tests pass, 0 vulnerabilities

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: vveerrgg

esbuild.browser.mjs

@@ -2,7 +2,8 @@ import { build } from 'esbuild';
 import path from 'path';
 
 // Plugin to replace Node builtins with empty modules (same as webpack fallback: false)
-// Exclude 'buffer' — nostr-crypto-utils uses the npm `buffer` polyfill package
+// Stub Node builtins that aren't needed in browser
+// Keep 'buffer' — still used by bech32 encoding in nostr-crypto-utils nip-19
 const emptyNodeBuiltins = {
   name: 'empty-node-builtins',
   setup(build) {
@@ -35,9 +36,10 @@ const result = await build({
   outfile: 'dist/browser/nostr-auth-middleware.min.js',
   target: ['es2020'],
   platform: 'browser',
-  external: ['express', 'winston'],
+  external: ['express', 'winston', 'jsonwebtoken'],
   alias: {
     '@': path.resolve('src'),
+    'nostr-crypto-utils': path.resolve('node_modules/nostr-crypto-utils/dist/cjs/index.js'),
   },
   plugins: [emptyNodeBuiltins],
   metafile: true,