[codex] Add Pubky Ring auth callbacks

[ben-kaufman]

Description

Fixes #913.

• Add Pubky Ring x-success, x-cancel, x-error, and x-source=Bitkit callback parameters before launching Ring auth.
• Handle bitkit://pubky-auth/success, bitkit://pubky-auth/cancel, and bitkit://pubky-auth/error deeplinks in the app.
• Keep relay-based completePubkyAuth() as the source of truth for successful session completion.
• Reset pending Ring auth UI on cancel/error callbacks and show the Ring error message when present.
• Add focused tests for callback URL generation and callback parsing.
• Clean existing import-order detekt findings so ./gradlew detekt reports no issues.

Preview

N/A, deeplink/auth flow change.

QA Notes

Validation run:

• git diff --check passed
• ./gradlew detekt passed with no findings
• ./gradlew compileDevDebugKotlin attempted, but blocked at :app:checkDevDebugAarMetadata because GitHub Packages credentials are missing (Username must not be null) for private Maven artifacts
• ./gradlew testDevDebugUnitTest attempted, but blocked for the same GitHub Packages credential issue

Suggested manual QA:

• Start Pubky Ring auth from Bitkit and approve in Ring; Bitkit should be reopened and continue the existing relay completion/import flow.
• Cancel in Ring; Bitkit should be reopened and the waiting/loading state should clear.
• Trigger a Ring error callback; Bitkit should be reopened, clear the pending auth state, and show an error toast.

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

[piotr-iohk]

Not sure if it is Bitkit or Ring, but going back to ring from Bitkit does not open the auth window correctly.
To reproduce:

• Import with Pubky Ring from Bitkit
• tap "Deny" in pubky-ring
• Import with Pubky Ring from Bitkit again
• see the Auth window does not appear (seems to be suppressed)

Below comparison with iOS (left), where the issue is not appearing:

Screen.Recording.2026-04-29.at.11.02.47.mov