Summary

Closes the keep-android follow-up from the NIP-98 over-broad-grant fix: the bunker approval screen did not show the HTTP URL/method being authorized.

NIP-98 (kind 27235) events carry empty content; the security-relevant u (URL) and method live in the event tags. The Rust signer core already surfaces these as BunkerApprovalRequest.httpAuth { url, method }, but Nip46ApprovalScreen never rendered them, so a user approving an HTTP-auth signature could not see which request they were authorizing.

This renders the URL and method in the approval details for kind-27235 requests, so HTTP-auth is not approved blind.

Changes

• Nip46ApprovalScreen: new httpAuthUrl/httpAuthMethod params; when present, renders sanitized "HTTP URL" and "HTTP Method" detail rows (a missing tag reads as "Unspecified", per the Rust contract, rather than being hidden).
• Nip46ApprovalActivity: passes request.httpAuth?.url / ?.method through.
• String resources for the two labels and the unspecified placeholder.

The URL/method are already sanitized in the signer core and are re-sanitized for display (sanitizeDisplayContent).

Testing

• Local: compileDebugKotlin, testDebugUnitTest, and lintDebug pass.

GH: #392

Summary by CodeRabbit

• New Features
  • NIP-46 approval requests now display HTTP authentication details, including the request URL and method.
  • Unspecified HTTP methods are clearly labeled.
  • Displayed security-related values are sanitized before being shown.