feat(nostr): flag events whose NIP-52 publish didn't land

Inventory reaches clients only through the republished calendar event,
and until now a publish that failed or was skipped left no durable
trace — only a log line, if that. Twice the drift was caught by a human
reading a wrong number on a public page (#35 on aio-demo, #51 on cfaun,
where an event's relay copy sat 14 days behind the DB).

Adds `events.nostr_publish_pending`, set before every attempt and
cleared only on a confirmed success. Ordering it that way is what makes
"the attempt was never made" — no signer resolved, no NostrClient, the
process died mid-flight — as discoverable as "the attempt raised". Both
shapes have now been observed in production; only the second one was
ever visible.

`set_ticket_paid` raises the flag inside its own update so the counters
and "the relay doesn't know about them yet" commit atomically, and the
sale path pays no extra write.

`publish_or_delete_nostr_event` now returns a bool so callers can
branch. The flag, not the return value, is the durable record — the
existing call sites stay correct ignoring it.

Publish failures move from WARNING to ERROR: the published ticket count
has stopped tracking reality, which is not routine journal noise.

Refs #35

nostr_hooks.py

@@ -12,7 +12,7 @@ from .models import Event
 from .nostr_publisher import publish_event_to_nostr
 
 
-async def publish_or_delete_nostr_event(event: Event, *, delete: bool = False) -> None:
+async def publish_or_delete_nostr_event(event: Event, *, delete: bool = False) -> bool:
     """Publish or delete the NIP-52 calendar event for `event`.
 
     Resolves a `NostrSigner` for the wallet owner — backend-agnostic
@@ -22,7 +22,22 @@ async def publish_or_delete_nostr_event(event: Event, *, delete: bool = False) -
     `await signer.sign_event(...)` for signing. Failures are logged
     and swallowed so a Nostr outage doesn't break the HTTP flow that
     triggered the publish.
+
+    Returns True when the event was signed and handed to the client,
+    False on any skip or failure. Callers are free to ignore it — the
+    `nostr_publish_pending` flag is the durable record, and the sweep
+    retries from that rather than from a return value.
     """
+    # Mark before attempting, clear only on confirmed success. Doing it
+    # in this order is what makes "the attempt was never made" — no
+    # signer, no NostrClient, process died mid-flight — as visible as
+    # "the attempt raised". Cheap guard so a re-publish of an already
+    # pending row doesn't write twice; `set_ticket_paid` sets the flag
+    # inside its own update so the sale path adds no extra write.
+    if not event.nostr_publish_pending:
+        event.nostr_publish_pending = True
+        await update_event(event)
+
     try:
         from lnbits.core.signers import resolve_for_wallet
 
@@ -45,14 +60,22 @@ async def publish_or_delete_nostr_event(event: Event, *, delete: bool = False) -
                 f"[EVENTS] No signer for wallet {event.wallet}, skipping "
                 f"NIP-52 {'delete' if delete else 'publish'} for event {event.id}"
             )
-            return
+            return False
 
         nostr_event = await publish_event_to_nostr(
             nostr_client, event, signer, delete=delete
         )
-        if nostr_event and not delete:
+        if nostr_event is None:
+            return False
+
+        event.nostr_publish_pending = False
+        if not delete:
             event.nostr_event_id = nostr_event.id
             event.nostr_event_created_at = nostr_event.created_at
-            await update_event(event)
+        await update_event(event)
+        return True
     except Exception as exc:
-        logger.warning(f"[EVENTS] Nostr publish failed: {exc}")
+        # ERROR, not warning: the row stays flagged and its published
+        # counts stay behind until the sweep or a later edit succeeds.
+        logger.error(f"[EVENTS] Nostr publish failed for event {event.id}: {exc}")
+        return False