fix(pairing): subscribe to signer replies BEFORE the handshake publishes

The relay pushes events only to subscriptions that exist at delivery time.
Both connect flows spawned the handshake task before run_demux registered the
kind-24133 author subscription, so a fast signer reply (the live Sep 23 Amber
scan: clean connect + secret echo, then get_public_key) landed in the gap and
was silently dropped — the identity RPC timed out 30s later and the session
died with 'The signer would not reveal its public key' after the connection
was already stored, leaving the UI signed in with no profile.

Both run_sign_task (bunker flow) and run_paired (QR pairing) now subscribe
first via subscribe_to_signer and hand the stream + subscription to run_demux.
futures-util promoted from dev-dependency to runtime. cargo test 209+3e2e
green, clippy 0, fmt clean, release rebuilt.

Cargo.toml

@@ -20,6 +20,7 @@ rpassword = "7"
 sha2 = "0.10"
 async-trait = "0.1"
 keyring = "4.2"
+futures-util = "0.3"
 
 [dev-dependencies]
 base64 = "0.22"