nostr: support full-range nip44 v2 payloads

[erskingardner]

Description

Extend the existing NIP-44 v2 encryption and decryption APIs to support the full plaintext range defined by the protocol.

Payloads from 1 through 65,535 bytes retain the existing two-byte big-endian length prefix. Larger payloads use the extended 00 00 marker followed by a four-byte big-endian length. Existing public APIs, signer paths, dependencies, features, and relay limits remain unchanged.

This also:

• authenticates payloads before decrypting or interpreting their length prefix
• uses checked u64 arithmetic for padding and payload sizes
• uses checked platform-size conversions and fallible buffer reservation
• raises the encoded payload ceiling to 5,726,623,156 bytes
• documents the memory implications of accepting protocol-maximum payloads
• adds a nostr changelog entry

Notes to the reviewers

Existing payloads below 65,536 bytes remain byte-for-byte compatible.

Tests cover:

• the official 65,535, 65,536, and 65,537-byte NIP-44 checksum vectors
• legacy and extended-prefix round trips
• truncated and non-canonical extended prefixes
• mismatched declared lengths and invalid padding
• empty and oversized plaintext
• maximum padding, raw payload, and Base64 arithmetic without allocating maximum-sized buffers
• platform-specific rejection of unrepresentable allocation sizes

Validation completed locally:

• focused NIP-44 tests with nip44 and nip44,os-rng
• no_std + alloc + nip44
• clippy with warnings denied
• the native workspace check, test, doctest, and clippy matrix
• all-feature documentation with warnings denied
• formatting and git diff --check

The wasm builds were attempted but could not complete locally because Apple clang lacks the wasm/WASI C backend required by secp256k1-sys. CI remains responsible for confirming the cross-target build.

Processing payloads near the protocol maximum can require several gigabytes of contiguous memory. Applications and relays should continue enforcing appropriate input-size limits before invoking decryption.

Checklist

• I followed the contribution guidelines
• I updated the relevant CHANGELOG.md (if applicable)
• I understand and can explain all code in this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[yukibtc]

utACK 0c71b5b