chore: bump version to 0.12.3

chore: bump version to 0.12.2

chore: release v0.12.1

feat: add --nsec-file for AV-friendly key storage, --nsec-exec alias

- --nsec-file <path>: writes nsec to file with 0600 permissions (no shell exec)
- --nsec-exec: alias for --nsec-cmd (kept for backward compat)
- SKILL.md updated to recommend --nsec-file as default
- Reduces AV false positives from sh -c exec pattern

fix: don't warn on all-bare relay markers in check

Per NIP-65, bare relay tags (no explicit read/write marker) mean the
relay is used for both reading and writing. This is valid and the
default for simple setups. Previously, nihao check would warn about
'no read/write markers' on identities created by nihao setup itself.

Changed from warn to pass with descriptive message.

fix: reject unknown flags and add --nsec alias

All commands now error on unknown flags instead of silently ignoring
them. Previously, typos like --nsec (instead of --sec) would be
silently ignored, leading to confusing behavior.

Also adds --nsec as an alias for --sec since it's the more intuitive
flag name when passing an nsec key.

feat: add --relays flag to check and backup commands

Allows querying custom relays instead of the hardcoded defaults.
Useful when the default relays don't have the target's data.

  nihao check npub1... --relays wss://relay1.com,wss://relay2.com
  nihao backup npub1... --relays wss://relay1.com,wss://relay2.com

feat: add backup command to export identity events as JSON

nihao backup <npub|nip05> exports all identity-related events:
kind 0 (profile), kind 3 (follows), kind 10002 (relay list),
kind 10050 (DM relays), kind 10019 (nutzap info), kind 17375/37375
(wallet). JSON goes to stdout, progress to stderr.

Also fixes fetchKindFrom to respect context cancellation — previously
could hang forever if a relay didn't respond to a query.

feat: auto-detect version from Go module build info

Replace hardcoded version="dev" with runtime/debug.ReadBuildInfo().
When installed via 'go install github.com/dergigi/nihao@vX.Y.Z',
the version is automatically embedded by Go. Local builds from a
tagged git repo also pick up the version from VCS info.

Also adds missing CHANGELOG entry for v0.10.0 and removes duplicate
v0.9.0 entry.

fix: pick latest event across relays in fetchKindFrom

Previously, fetchKindFrom returned the first event received from any
relay. For replaceable events (kind 0, 3, 10002, etc.), different relays
may hold different versions. Per NIP-01, the event with the latest
created_at is canonical.

Now collects results from all connected relays and returns the one with
the highest created_at timestamp.