Switch credential domain and Android deep links from ditto.pub to agora.spot

The iOS Associated Domains entitlement, Android intent filters, AASA
file, and assetlinks.json already reference agora.spot. Three call
sites still hard-coded ditto.pub:

- CREDENTIAL_DOMAIN in src/lib/credentialManager.ts, which keys iCloud
  Keychain Shared Web Credentials by domain. Saved nsecs were being
  filed under ditto.pub and so could never be matched against the
  agora.spot AASA file.
- MainActivity.handleNotificationIntent host check, which only routed
  the WebView when the tapped notification's URI host equaled
  ditto.pub.
- NostrPoller.showNotification, which built notification PendingIntents
  pointing at https://ditto.pub/notifications.

android/app/src/main/java/spot/agora/app/MainActivity.java

@@ -63,7 +63,7 @@ public class MainActivity extends BridgeActivity {
     private void handleNotificationIntent(Intent intent) {
         if (intent == null) return;
         Uri data = intent.getData();
-        if (data != null && "ditto.pub".equals(data.getHost())) {
+        if (data != null && "agora.spot".equals(data.getHost())) {
             String path = data.getPath();
             if (path != null && !path.isEmpty()) {
                 // Wait for WebView to be ready, then navigate

android/app/src/main/java/spot/agora/app/NostrPoller.java

@@ -337,7 +337,7 @@ public class NostrPoller {
         if (manager == null) return;
 
         Intent intent = new Intent(context, MainActivity.class);
-        intent.setData(Uri.parse("https://ditto.pub/notifications"));
+        intent.setData(Uri.parse("https://agora.spot/notifications"));
         intent.setFlags(Intent.FLAG_ACTIVITY_SINGLE_TOP | Intent.FLAG_ACTIVITY_CLEAR_TOP);
         PendingIntent pendingIntent = PendingIntent.getActivity(
                 context, id, intent,

src/lib/credentialManager.ts

@@ -21,7 +21,7 @@ import { SavePassword } from '@capgo/capacitor-autofill-save-password';
 import { downloadTextFile } from '@/lib/downloadFile';
 
 /** The domain used for Shared Web Credentials on iOS. */
-const CREDENTIAL_DOMAIN = 'ditto.pub';
+const CREDENTIAL_DOMAIN = 'agora.spot';
 
 /** Whether the browser supports PasswordCredential (Chromium-only). */
 export function supportsPasswordCredential(): boolean {