Fix base64 encoding to keep padding for Go URLEncoding (v0.39.3)

- Remove padding stripping from URL-safe base64 conversion
- Go's base64.URLEncoding expects padding characters
- Fix applied to LogView.svelte, BlossomView.svelte, and api.js

Files modified:
- app/web/src/LogView.svelte: Keep padding in auth header
- app/web/src/BlossomView.svelte: Keep padding in auth header
- app/web/src/api.js: Keep padding in auth header
- pkg/version/version: Bump to v0.39.3

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/web/src/BlossomView.svelte

@@ -76,8 +76,8 @@
             };
 
             const signedEvent = await signer.signEvent(authEvent);
-            // Use URL-safe base64 encoding
+            // Use URL-safe base64 encoding (replace + with -, / with _)
-            return btoa(JSON.stringify(signedEvent)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+            return btoa(JSON.stringify(signedEvent)).replace(/\+/g, '-').replace(/\//g, '_');
         } catch (err) {
             console.error("Error creating Blossom auth:", err);
             return null;

app/web/src/LogView.svelte

@@ -75,8 +75,8 @@
             };
 
             const signedEvent = await userSigner.signEvent(authEvent);
-            // Use URL-safe base64 encoding (replace + with -, / with _, remove padding)
+            // Use URL-safe base64 encoding (replace + with -, / with _)
-            return btoa(JSON.stringify(signedEvent)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+            return btoa(JSON.stringify(signedEvent)).replace(/\+/g, '-').replace(/\//g, '_');
         } catch (err) {
             console.error("Error creating auth header:", err);
             return null;

app/web/src/api.js

@@ -30,8 +30,8 @@ export async function createNIP98Auth(signer, pubkey, method, url) {
 
         // Sign using the signer
         const signedEvent = await signer.signEvent(authEvent);
-        // Use URL-safe base64 encoding
+        // Use URL-safe base64 encoding (replace + with -, / with _)
-        return btoa(JSON.stringify(signedEvent)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+        return btoa(JSON.stringify(signedEvent)).replace(/\+/g, '-').replace(/\//g, '_');
     } catch (error) {
         console.error("Error creating NIP-98 auth:", error);
         return null;

pkg/version/version

@@ -1 +1 @@
-v0.39.2
+v0.39.3