chore: DRY up auth approval for signup deeplinks

[SHAcollision]

Low priority
This PR changes:

• Parse pubkyauth URLs once and route signup vs relay auth from a single path.
• Decrease complexity of some functions and remove the clippy allow for high cognitive complexity.
• Reuse shared token-posting helper for relay flows (signup / signin).
• Explicitly support direct signup deeplinks (no relay/secret) without duplicating logic.
• Updated canonical ordering of the params from mandatory first (hs) to optional last (st...) and the test expectation strings.
• The caps param is now not enforced. By PubkyAuth standard an AuthToken with no capabilities is used to "authenticate" (prove identity). When some capabilities are requested, then it is used to "authorize" (give access to that scope). Previously caps were always enforce to exist.
• The parsing logic now enforces relay and secret pairing: if one is present without the other, parsing fails.