Sign NIP-98 auth for nostr.build image uploads

frontend/electron/main.ts

@@ -153,12 +153,24 @@ async function pickImage(): Promise<{ path: string; name: string; mime: string }
 
 /** Upload one image file to nostr.build and return the public URL + MIME type. */
 async function uploadImage(filePath: string): Promise<{ url: string; mime: string }> {
+  const uploadUrl = 'https://nostr.build/api/v2/upload/files';
   const data = readFileSync(filePath);
   const mime = mimeForPath(filePath);
+
+  // nostr.build requires a NIP-98 auth token signed with the active profile's key.
+  const authEnvelope = (await backendRequest('upload_auth', {
+    url: uploadUrl,
+    http_method: 'POST',
+  })) as { status: string; data?: { authorization?: string }; message?: string };
+  if (authEnvelope.status !== 'ok' || !authEnvelope.data?.authorization) {
+    throw new Error(authEnvelope.message ?? 'Could not authorize the upload.');
+  }
+
   const form = new FormData();
   form.append('fileToUpload', new Blob([data], { type: mime }), path.basename(filePath) || 'image');
-  const response = await fetch('https://nostr.build/api/v2/upload/files', {
+  const response = await fetch(uploadUrl, {
     method: 'POST',
+    headers: { authorization: authEnvelope.data.authorization },
     body: form,
   });
   const payload = (await response.json().catch(() => ({}))) as {