feat: multi-ticket purchases as N rows sharing one payment_hash

Replaces the previous "one row, N seats via extra.quantity" model
with proper one-row-per-attendee semantics. Each attendee gets a
unique scannable id; the door PUT /register/{ticket_id} marks
them registered independently — so a buyer can purchase 3 tickets,
hand 2 QRs to friends arriving separately, and each attendee can
enter on their own schedule.

Schema (migrations_fork.py m002):
- ticket.payment_hash: new TEXT column shared across all rows of
  a multi-ticket purchase. Backfilled `payment_hash = id` for
  pre-migration rows (id WAS the payment_hash by invariant).

Wire:
- TicketPaymentRequest grows `ticket_ids: list[str]` so the
  webapp gets every scannable id back in the create response.
- POST /tickets/{event_id}/{payment_hash} polling endpoint now
  reports `ticket_ids` (every row) + keeps `ticket_id` for
  back-compat.
- api_ticket_create loops quantity times; the first row reuses
  payment_hash as id (preserves legacy `id == payment_hash`
  invariant for single-ticket purchases), the rest get
  urlsafe_short_hash() uuids.

Payment flow:
- on_invoice_paid fetches all rows by payment_hash and marks each
  paid via set_ticket_paid, which now increments event.sold by 1
  per row (was N per row via extra.quantity — simpler now). The
  per-event asyncio lock still serializes counter + republish so
  concurrent multi-ticket purchases for the same event don't
  reorder the published Nostr state.
- Each paid row triggers its own send_ticket_notification_in_
  background call — no-op for buyers without nostr_identifier /
  email, useful when the buyer set those on the row.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

views_api.py

@@ -17,6 +17,7 @@ from lnbits.core.crud.wallets import get_wallet
 from lnbits.core.models import Account, User, WalletTypeInfo
 from lnbits.core.models.payments import CreateInvoice
 from lnbits.core.services import create_payment_request
+from lnbits.helpers import urlsafe_short_hash
 from lnbits.decorators import (
     check_admin,
     check_user_exists,
@@ -46,6 +47,7 @@ from .crud import (
     get_settings,
     get_ticket,
     get_tickets,
+    get_tickets_by_payment_hash,
     get_tickets_by_user_id,
     purge_unpaid_tickets,
     update_event,
@@ -508,8 +510,16 @@ async def api_ticket_create(
         )
     if event.canceled:
         raise HTTPException(status_code=HTTPStatus.GONE, detail="Event is canceled.")
-    if event.amount_tickets > 0 and event.sold >= event.amount_tickets:
-        raise HTTPException(status_code=HTTPStatus.GONE, detail="Event is sold out.")
+    quantity = data.quantity
+    if event.amount_tickets > 0:
+        if event.sold >= event.amount_tickets:
+            raise HTTPException(status_code=HTTPStatus.GONE, detail="Event is sold out.")
+        remaining = event.amount_tickets - event.sold
+        if quantity > remaining:
+            raise HTTPException(
+                status_code=HTTPStatus.BAD_REQUEST,
+                detail=f"Only {remaining} ticket(s) remaining for this event.",
+            )
 
     name = data.name
     email = data.email
@@ -531,7 +541,7 @@ async def api_ticket_create(
                 status_code=HTTPStatus.BAD_REQUEST,
                 detail="Invalid Nostr identifier.",
             ) from exc
-    price = event.price_per_ticket
+    unit_price = event.price_per_ticket
     extra: dict[str, Any] = {"tag": "events", "name": name, "email": email}
 
     if promo_code:
@@ -543,7 +553,9 @@ async def api_ticket_create(
         # get the promocode
         promo = next(pc for pc in event.extra.promo_codes if pc.code == promo_code)
         extra["promo_code"] = promo.code
-        price = event.price_per_ticket * (1 - promo.discount_percent / 100)
+        unit_price = event.price_per_ticket * (1 - promo.discount_percent / 100)
+    # Scale by quantity AFTER the promo applies. One invoice, N tickets.
+    price = unit_price * quantity
 
     if payment_method == "fiat" and not event.allow_fiat:
         raise HTTPException(
@@ -600,21 +612,32 @@ async def api_ticket_create(
             extra=extra,
         ),
     )
-    await create_ticket(
-        payment_hash=payment.payment_hash,
-        wallet=event.wallet,
-        event=event.id,
-        name=name,
-        email=email,
-        user_id=user_id,
-        extra={
-            "applied_promo_code": promo_code,
-            "refund_address": refund_address,
-            "nostr_identifier": nostr_identifier,
-            "ticket_base_url": str(request.base_url).rstrip("/"),
-            "sats_paid": payment.sat,
-        },
-    )
+    # Multi-ticket purchases land as N rows sharing the LNbits invoice
+    # payment_hash but with distinct `id`s — one independently
+    # scannable QR per attendee. The first row reuses payment_hash as
+    # its id so the legacy single-purchase invariant
+    # (`id == payment_hash`) still holds for quantity == 1 callers.
+    ticket_ids: list[str] = []
+    sats_per_ticket = payment.sat // quantity if quantity else payment.sat
+    for index in range(quantity):
+        row_id = payment.payment_hash if index == 0 else urlsafe_short_hash()
+        await create_ticket(
+            payment_hash=payment.payment_hash,
+            wallet=event.wallet,
+            event=event.id,
+            name=name,
+            email=email,
+            user_id=user_id,
+            ticket_id=row_id,
+            extra={
+                "applied_promo_code": promo_code,
+                "refund_address": refund_address,
+                "nostr_identifier": nostr_identifier,
+                "ticket_base_url": str(request.base_url).rstrip("/"),
+                "sats_paid": sats_per_ticket,
+            },
+        )
+        ticket_ids.append(row_id)
 
     return TicketPaymentRequest(
         payment_hash=payment.payment_hash,
@@ -622,30 +645,34 @@ async def api_ticket_create(
         fiat_payment_request=getattr(payment, "extra", {}).get("fiat_payment_request"),
         fiat_provider=getattr(payment, "fiat_provider", None) or fiat_provider,
         is_fiat=bool(getattr(payment, "fiat_provider", None) or fiat_provider),
+        ticket_ids=ticket_ids,
     )
 
 
 @tickets_api_router.post("/{event_id}/{payment_hash}")
 async def api_ticket_payment_status(event_id: str, payment_hash: str) -> dict:
-    """Poll-style payment confirmation for a pending ticket.
+    """Poll-style payment confirmation for a pending ticket purchase.
 
-    The webapp's `useTicketPurchase` polls this every 2s after firing
-    `Pay with Wallet` (or after presenting the QR for an external
-    wallet) until `paid: true` comes back, then advances to the
-    ticket-QR success state. The companion WebSocket at
-    `/tickets/ws/{payment_hash}` is more efficient for pushes — this
-    endpoint is the fallback for clients that can't open a relay-side
-    socket.
+    The webapp polls this every 2s after presenting the invoice until
+    `paid: true` comes back, then advances to the success state. The
+    companion WebSocket at `/tickets/ws/{payment_hash}` is more
+    efficient for pushes — this endpoint is the fallback.
 
-    Returns `{paid: bool, ticket_id?: str}` so the client can hand off
-    to the ticket-detail flow without an extra GET. A missing /
-    cross-event ticket returns `paid: false` rather than 404 so the
-    poll loop doesn't have to special-case the not-yet-created race.
+    Returns `{paid, ticket_ids: [...]}` so multi-ticket buyers get
+    every scannable id back in one response (one for single-ticket
+    purchases). A missing / cross-event purchase returns
+    `paid: false` rather than 404 so the poll doesn't have to
+    special-case the not-yet-created race.
     """
-    ticket = await get_ticket(payment_hash)
-    if not ticket or ticket.event != event_id:
+    tickets = await get_tickets_by_payment_hash(payment_hash)
+    relevant = [t for t in tickets if t.event == event_id]
+    if not relevant:
         return {"paid": False}
-    return {"paid": ticket.paid, "ticket_id": ticket.id}
+    return {
+        "paid": all(t.paid for t in relevant),
+        "ticket_id": relevant[0].id,  # back-compat with single-ticket clients
+        "ticket_ids": [t.id for t in relevant],
+    }
 
 
 @tickets_api_router.websocket("/ws/{payment_hash}")