Update provisioning URL and streamline SSH key delivery

Fixes the hardcoded 'https://' in the stub provisioner's lnbitsUrl to 'http://' and implements an atomic, first-retrieval SSH private key delivery mechanism.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 418bf6f8-212b-4bb0-a7a5-8231a061da4e
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: 2f0c982b-02f6-4381-9fc4-34f489842999
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/9f85e954-647c-46a5-90a7-396e495a805a/418bf6f8-212b-4bb0-a7a5-8231a061da4e/sPDHkg8
Replit-Helium-Checkpoint-Created: true

artifacts/api-server/src/lib/provisioner.ts

@@ -497,7 +497,7 @@ export class ProvisionerService {
         dropletId: fakeDropletId,
         nodeIp: "198.51.100.42",
         tailscaleHostname: `timmy-node-${jobId.slice(0, 8)}.tail1234.ts.net`,
-        lnbitsUrl: `https://timmy-node-${jobId.slice(0, 8)}.tail1234.ts.net`,
+        lnbitsUrl: `http://timmy-node-${jobId.slice(0, 8)}.tail1234.ts.net:3000`,
         sshPrivateKey: privateKey,
         updatedAt: new Date(),
       })
@@ -568,8 +568,10 @@ export class ProvisionerService {
         ? `timmy-node-${jobId.slice(0, 8)}.${this.tsTailnet}.ts.net`
         : null;
 
+    // LNbits listens on port 3000 (HTTP). Tailscale encrypts the link at the
+    // network layer, so http:// is correct — no TLS termination on the service.
     const lnbitsUrl = tailscaleHostname
-      ? `https://${tailscaleHostname}`
+      ? `http://${tailscaleHostname}:3000`
       : nodeIp
         ? `http://${nodeIp}:3000`
         : null;