Merge upstream v1.6.8 into the aio fork

Brings in ticket waves (per-wave price/currency/stock/fiat), the paginated
ticket endpoint, the organiser ticket-image template, and the SatsPay
on-chain surface. Refs #33.

Resolutions that were not mechanical, and why:

- set_ticket_paid debits the wave named on the ticket, keeping upstream's
  `> 0` guards; ours decremented unconditionally and could go negative.
  The purchase and free-ticket paths now stamp ticket_wave_id /
  ticket_wave_title, without which every sale would debit the primary wave.

- Pricing moved onto the selected wave (basket_totals takes it as a required
  argument, the promo-validate endpoint resolves the same wave through the
  shared _resolve_ticket_wave). event.price_per_ticket is a roll-up of the
  PRIMARY wave since sync_event_ticket_waves, so pricing off the event
  quoted and charged the first wave's price to buyers who picked a later
  one. Regression test added.

- Kept npub support in two places upstream removed it: the purchase
  endpoint's normalize_public_key path and the notification dispatcher.
  Upstream's replacement rejects with "Only NIP-05 Nostr identifiers are
  supported", which is false for this fork. The purchase-side rejection had
  merged in outside any conflict marker.

- _ticket_image_url existed on both sides as two unrelated features. Ours
  (always-attached rendered QR card) is now _ticket_card_url; upstream's
  (organiser template, opt-in per wave) keeps the name. Both are wired into
  the mail, and the /qr/{ticket_id} endpoint — also duplicated on both
  sides, on the same route — is merged into one handler rather than
  registered twice, where the second copy would have been unreachable.

- models._parse_date now accepts a full ISO datetime. Upstream's date-only
  strptime raised ValueError on any event whose closing_date carries a time,
  which create_event produces by defaulting it from event_end_date — it
  would have 500'd the purchase path, the public event gate and the promo
  preview. Reproduced before fixing.

- Dropped upstream's inline make_qr_png (we import a superset from .qr) and
  its duplicate paymentMethodOptions in display.js, which re-derived payment
  options from per-method booleans and offered an on-chain option the
  backend rejects; the submit gate now matches the template's condition.

- Restored imports the merge silently dropped with upstream's npub removal
  (normalize_public_key, normalize_private_key, DEFAULT_NOSTR_RELAYS).

Event create/update stays ours: upstream's combined endpoint would have
replaced the approval workflow and the explicit field allowlist that keeps
`status` out of the request body.

mypy error set is unchanged from HEAD; ruff, black and the 97 tests pass.

static/js/display.vue

@@ -74,7 +74,7 @@
                   filled
                   dense
                   v-model.trim="formDialog.data.nostr_identifier"
-                  label="(optional) Nostr NIP-05 or npub"
+                  label="(optional) Nostr NIP-05"
                   hint="If provided, we'll DM your ticket link after payment."
                 ></q-input>
               </div>
@@ -89,6 +89,21 @@
               lazy-rules
               :hint="`If minimum tickets (${event.extra?.min_tickets}) are not met, refund will be sent.`"
             ></q-input>
+            <q-select
+              v-if="showTicketWaveSelector"
+              filled
+              dense
+              v-model="formDialog.data.ticket_wave_id"
+              emit-value
+              map-options
+              label="Ticket wave"
+              :options="
+                activeTicketWaves.map(wave => ({
+                  label: `${wave.title} - ${wave.price_per_ticket} ${wave.currency}`,
+                  value: wave.id
+                }))
+              "
+            ></q-select>
             <div class="row q-col-gutter-md q-pt-lg items-center">
               <div v-if="paymentMethods.length > 1" class="col-auto">
                 <q-option-group
@@ -117,7 +132,8 @@
                 :disable="
                   formDialog.data.name == '' ||
                   formDialog.data.email == '' ||
-                  Boolean(paymentReq)
+                  (showTicketWaveSelector && !formDialog.data.ticket_wave_id) ||
+                  (receive.show && Boolean(paymentReq))
                 "
                 type="submit"
                 >Submit</q-btn