feat(deploy): provision VITE_SPIRE_SEED for bunker pairing (Phase E)

provision-atm.sh now writes VITE_SPIRE_SEED (the spire-seed:v1: pairing seed
from spirekeeper) as the production identity, validating the scheme prefix;
the generated nsec path is kept only as a dev fallback when SPIRE_SEED is
unset. Relay default moved to the LNbits bundled nostrrelay
(ws://$HOST_IP:5001/nostrrelay/test). .env templates (live.nix + the flake's
installed-default) swap VITE_ATM_PRIVATE_KEY → VITE_SPIRE_SEED and drop the
dead LP-era vars. README notes state.db now also holds the bunker binding
(keep it or re-pair).

Part of Phase E, aiolabs/bitspire#52. Unblocks the Sintra live-pairing smoke.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

flake.nix

@@ -200,7 +200,7 @@
                   cp ${pkgs.writeText "bitspire-env-default" ''
                     VITE_RELAY_URL=${config.services.bitspire.relayUrl}
                     VITE_LNBITS_SERVER_PUBKEY=
-                    VITE_ATM_PRIVATE_KEY=
+                    VITE_SPIRE_SEED=
                     VITE_APP_ID=
                     VITE_OPERATOR_PUBKEYS=
                     VITE_LAMASSU_MACHINE_MODEL=${machineModel}