feat: expose ticket waves on public event responses

A buyer cannot choose a ticket wave without its id, and nothing public
carried one: `PublicEventExtra` is `EventExtraBase`, which did not
include `ticket_waves`, and the NIP-52 tags deliberately publish only
the active wave with no identifier (#61). So `GET /events/{id}` and
`/events/public` gave a client everything except the one field it needs
to say which tier it wants — and the purchase endpoint refuses when
several waves are open.

Moves `ticket_waves` from `EventExtra` to `EventExtraBase`, leaving
`promo_codes` as the only organizer-private field in `extra`.

A wave holds an id, title, date window, currency, price, remaining stock
and the fiat flags — the sales information a buyer needs in order to
choose. The only thing publishing it reveals is the upcoming price
schedule, which is precisely what #61 recorded as the cost of settling
on flat Nostr tags; over REST it is a gain rather than a leak.

Prerequisite for wave support in the webapp, which otherwise cannot
offer a wave picker to anyone but the organizer.

Two tests pin the projection: the public extra carries waves and never
promo codes, and a serialised `PublicEvent` shows the same.

tests/test_ticket_models.py

@@ -5,6 +5,10 @@ from ..models import (
     CreateEvent,
     CreateTicket,
     EventExtra,
+    PromoCode,
+    PublicEvent,
+    PublicEventExtra,
+    TicketWave,
     effective_payment_methods,
 )
 
@@ -108,3 +112,63 @@ def test_payment_methods_are_normalised_and_deduplicated():
 def test_unknown_payment_method_is_rejected():
     with pytest.raises(ValidationError):
         EventExtra(payment_methods=["cash"])
+
+
+# --- public projection ------------------------------------------------------
+
+
+def test_public_extra_exposes_waves_but_never_promo_codes():
+    """A buyer needs a wave id to choose a tier, so waves are public; promo
+    codes stay organizer-only (aiolabs/events#61, v1.6.1-aio.12)."""
+    organizer = EventExtra(
+        promo_codes=[PromoCode(code="SECRET", discount_percent=50)],
+        ticket_waves=[
+            TicketWave(
+                id="early",
+                title="Early",
+                opening_date="2030-01-01",
+                closing_date="2030-02-01",
+                currency="sat",
+                price_per_ticket=10,
+                amount_tickets=5,
+            )
+        ],
+    )
+
+    public = PublicEventExtra(**organizer.dict())
+
+    assert [wave.id for wave in public.ticket_waves] == ["early"]
+    assert public.ticket_waves[0].price_per_ticket == 10
+    assert not hasattr(public, "promo_codes")
+    assert "promo_codes" not in public.dict()
+
+
+def test_public_event_response_carries_waves():
+    """End of the chain: what `GET /events/{id}` actually serialises."""
+    wave = TicketWave(
+        id="regular",
+        title="Regular",
+        opening_date="2030-01-01",
+        closing_date="2030-02-01",
+        currency="sat",
+        price_per_ticket=25,
+        amount_tickets=40,
+    )
+    organizer_extra = EventExtra(
+        ticket_waves=[wave], promo_codes=[PromoCode(code="SECRET")]
+    )
+    public = PublicEvent(
+        id="evt",
+        name="Test",
+        info="",
+        canceled=False,
+        event_start_date="2030-01-01",
+        currency="sat",
+        price_per_ticket=25,
+        banner=None,
+        extra=PublicEventExtra(**organizer_extra.dict()),
+    )
+    body = public.dict()
+
+    assert [w["id"] for w in body["extra"]["ticket_waves"]] == ["regular"]
+    assert "promo_codes" not in body["extra"]