Migrate to applesauce v6

Remove applesauce-factory (deleted in v6) and bump applesauce-core,
applesauce-relay, and applesauce-signers to ^6.2.x. Rewrite all
EventFactory usage from the removed constructor API
(`new EventFactory({ signer }).sign(template)`) to the new chainable
builder (`EventFactory.fromKind(k).content(...).sign(signer)`).

Remove `relay.eoseTimeout` overrides in nostr-auth — the eoseTimeout
property was removed in v6; NostrConnectSigner now uses persistent
subscriptions that don't rely on EOSE-based timeouts.

Update photo-gallery test mock to use 64-char hex pubkeys/ids/sigs
because v6's sign() validates event structure via validateEvent().

Also includes safe semver bumps to all other dependencies.

app/services/blossom.js

@@ -35,23 +35,20 @@ export default class BlossomService extends Service {
   }
 
   async _getAuthHeader(action, hash, serverUrl) {
-    const factory = new EventFactory({ signer: this.nostrAuth.signer });
     const now = Math.floor(Date.now() / 1000);
     const serverHostname = new URL(serverUrl).hostname;
 
-    const authTemplate = {
-      kind: 24242,
-      created_at: now,
-      content: action === 'upload' ? 'Upload photo for place' : 'Delete photo',
-      tags: [
+    const authEvent = await EventFactory.fromKind(24242)
+      .content(action === 'upload' ? 'Upload photo for place' : 'Delete photo')
+      .modifyPublicTags(() => [
         ['t', action],
         ['x', hash],
         ['expiration', String(now + 3600)],
         ['server', serverHostname],
-      ],
-    };
-
-    const authEvent = await factory.sign(authTemplate);
+      ])
+      .created(now)
+      .as(this.nostrAuth.signer)
+      .sign();
     const base64 = btoa(JSON.stringify(authEvent));
     const base64url = base64
       .replace(/\+/g, '-')