Add Nsec Oracle extension

[santyr]

Adds Nsec Oracle to the vetted registry.

• Repo: https://github.com/lightning-goats/nsec_oracle
• Release: v1.0.0

What it is

An in-instance Nostr signing oracle for LNbits: it holds Nostr keys server-side (encrypted at rest with the instance secret) and lets other installed extensions — and admin-key API clients — sign events and encrypt/decrypt through per-key, per-kind permissions with rate limits and an audit log, without the key ever leaving the oracle. It also auto-discovers extensions that declare nostr_signing requirements.

How it differs from nostr_bunker

This is deliberately not a relay-facing remote signer. lnbits/nostr_bunker serves external Nostr apps over bunker:// / nostrconnect://; Nsec Oracle serves in-instance consumers (extensions + local API). They're complementary, not overlapping — the extension explicitly points external users to nostr_bunker.

Checklist

• ✅ No new dependencies — uses only what LNbits already ships (FastAPI, pynostr, nostr_sdk).
• ✅ Fully working — encrypted key vault, permissions, rate limits, NIP-04/44, discovery, audit log; 21 tests passing.
• ✅ id nsec_oracle is unique in the registry.
• ✅ Icon is a PNG served from main; the hash matches the tagged source archive.