feat: open Pubky auth links from iOS

[ovitrif]

Parent: #712
Source: Pubky marketplace Bitkit team brief

Android already supports the pubkyauth deep link; matching flow coverage is tracked in synonymdev/bitkit-android#1212.

Scope

• Register pubkyauth as an inbound URL scheme.
• Route valid setup URLs to the existing approval sheet and watch-only consent step.
• Reject malformed or unsupported claims without approving or exporting account material.
• Add a journey for browser or external-app handoff into the approval flow.

Acceptance criteria

• A marketplace setup link opens Bitkit directly and reaches watch-only consent.
• Scan and paste remain functional.

[ovitrif]

External dependency: the marketplace setup producer must emit the unique bitkit://pubky-auth/setup?<original query> target with exactly one supported Bitkit claim marker, while leaving generic Pubky App and Pubky Ring pubkyauth flows unchanged. Paykit's trust-boundary ownership remains tracked in pubky/paykit-rs#148.

@ben-kaufman @dzdidi please confirm ownership of the external producer handoff. The Bitkit receiver is implemented in PR #722, independently reviewed, and green.