refactor(desktop): share relay request construction

[bradseiler]

Summary

This is a behavior-preserving refactor that gives the desktop relay HTTP bridge one helper for authenticated request construction. It moves the repeated Authorization, JSON content type, optional x-auth-tag, body, and timeout setup into build_authenticated_relay_request.

The helper uses the final URL, auth header, and body bytes passed by the caller. It does not sign, reserialize, normalize, send, parse, classify errors, choose a client, or handle rate limits.

Excluded paths: media, WebSocket, Git, agents, mobile, and NIP-FI. The query send helper only routes through the new request builder so the timeout and x-auth-tag behavior are covered by the same seam.

Related issue

None found. This prepares for the enterprise identity follow-up to be smaller than #7663.

Testing

• cargo fmt --manifest-path desktop/src-tauri/Cargo.toml --check passed at 356676a2f70f6bdf80cfdcb9084f1f7548359ecb.
• cargo test --manifest-path desktop/src-tauri/Cargo.toml relay::tests::authenticated -- --nocapture passed at 356676a2f70f6bdf80cfdcb9084f1f7548359ecb.
• just desktop-tauri-check passed at 356676a2f70f6bdf80cfdcb9084f1f7548359ecb.
• just desktop-tauri-test passed at 356676a2f70f6bdf80cfdcb9084f1f7548359ecb.
• just desktop-tauri-clippy passed at 356676a2f70f6bdf80cfdcb9084f1f7548359ecb.

Generated with Codex

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is c507a4d488ca27796e78d876b9c24ee38442cc1b...356676a2f70f6bdf80cfdcb9084f1f7548359ecb.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 356676a2f70f6bdf80cfdcb9084f1f7548359ecb to authorize a new review.
Any previous review applies only to its recorded range.