perf(mobile): stop re-deriving the pubkey on every event signature

[odedlaz]

Event.from derives the signer's pubkey whenever the caller omits it — a second elliptic-curve multiply on top of the signature, for a value that is constant per identity. None of the nine call sites supplied it.

That is not free here: the crypto is pure-Dart bigint math (nostr over pointycastle), with no native secp256k1 binding. Measured host-AOT on an M-series machine, dart compile exe, n=300:

variant	p50	p95
Event.from as the call sites used it	8.13ms	8.93ms
Event.from with pubkey: supplied	5.41ms	5.50ms

A 120Hz frame is 8.333ms, and none of this work runs on another isolate — the app contains exactly one compute() and it parses emoji data. The sites that matter most are the NIP-98 header built for every authenticated HTTP request (relay_session.dart, reached from channel pagination, thread open, and mention autocomplete while typing), NIP-42 AUTH on every reconnect (relay_socket.dart), and message send (signed_event_relay.dart).

The change adds a memoized derive — one multiply per identity instead of one per event — and supplies the result at all nine sites.

Why this is behaviour-identical

Asserted rather than argued, since it is crypto-adjacent. test/shared/relay/event_signing_test.dart checks that the same secret key and timestamp produce the same event id, the same pubkey, and a valid signature whether the pubkey is supplied or derived. Event's id hash lower-cases the pubkey before hashing, so a supplied key cannot change the id or the signature; Schnorr.derivePublicKey already returns lower-case hex, so the serialized field is unchanged too.

The cache holds one key. The app signs with one identity at a time and switches on community change, so a single slot hits on every call in a run of signatures without retaining keys it no longer needs.

Scope

This reduces the per-signature cost. It does not move signing off the UI isolate — async/await yields within the same isolate, so offloading has to be explicit, and at 5.41ms the remaining cost is still about 65% of a 120Hz frame. That is a separate change.

The host-AOT figures bound the order of magnitude; they are not device numbers, and an on-device measurement can only be worse. iOS profiling is blocked on tooling in my environment, so the frame-level confirmation is still outstanding.

Verification

flutter analyze clean, dart format clean, and the full mobile suite green — 1548 tests, including the pairing and relay-session suites that cover the touched call sites.