show authorization code during device key approval

docs/nip4e-audit.md

@@ -23,9 +23,13 @@
 > pubkey, the 4454 notification parses the requester key from the `P` tag, the
 > NotSet "Retry" button re-checks for an announcement instead of silently
 > generating (rotating) a new encryption key, and the restore dialog's
-> inverted empty-key check is fixed. Still open: the remaining security notes
-> in section 4 (plaintext backup file, one-click approval without a
-> verification code).
+> inverted empty-key check is fixed. Additionally, the `client` tag and
+> `client_name` were dropped from announcements/requests, and the PsstPsst
+> authorization code was adapted: both sides display the first 8 hex chars of
+> the requester client pubkey (`XXXX XXXX`) — the approver in the request
+> notification, the requester in the "Wait for approval" notification — so the
+> transfer can be verified out of band before approving. Still open: the
+> plaintext backup file in section 4.
 
 **Scope**: `crates/nip4e/src/lib.rs` (key announcement/sync), the send path (`crates/chat/src/room.rs`), the receive path (`crates/chat/src/lib.rs`), UI integration (`crates/workspace`), compared against the [NIP-4e draft](https://github.com/nostr-protocol/nips/blob/per-device-keys/4e.md) and [PsstPsst's implementation](https://github.com/CodyTseng/psstpsst) (`docs/protocols/nip4e.md` + `docs/protocols/nip17-extensions.md`, plus rust-nostr's NIP-59 source to verify crypto mechanics).