I agree, the secret should be deleted after "pairing" then the client keypair become the "API key"

If it didn't work, it's because zsp is not fully compliant with NIP-46. The secret is not even required, it's up to the bunker to enforce it or not. As for me, there is no need to update the NIP.