Attach Blossom auth token in clients

[tlongwell-block]

Summary

• add a global CLI --api-token / BUZZ_API_TOKEN and pass it through BuzzClient
• attach configured API tokens as X-Auth-Token on Blossom /media/upload from CLI and desktop
• persist/pair workspace tokens for mobile and pass them into mobile media uploads

Testing

• PATH="$PWD/bin:$PATH" just test-unit
• pre-push hook via PATH="$PWD/bin:$PATH" git push -u origin fix/blossom-auth-token
  • rust-tests ✅
  • desktop-test ✅
  • mobile-test ✅
  • desktop-tauri-test ✅
• prior targeted checks before commit:
  • cargo check -p buzz-cli
  • targeted CLI tests including api_token_flag_is_available
  • flutter test in mobile (44 tests)
  • flutter analyze in mobile
  • just desktop-tauri-check

Notes

• Tokens are optional and normalized by trimming whitespace; empty values are treated as absent.
• The token is only an extra Blossom upload credential and does not replace Nostr identity/auth.

[tlongwell-block]

Superseded by #1444. This earlier branch propagated bearer-token media auth; the replacement removes the media token path and uses Blossom kind:24242 + NIP-43 membership instead.