fix: honour per-wave fiat when the organiser set an explicit rail list

Reported from aio-demo: an event with fiat enabled, Card offered at
checkout, and the purchase refused with "Fiat payments are not enabled
for this ticket wave."

`effective_payment_methods` returned the organiser's explicit
`extra.payment_methods` list before ever consulting the wave:

    explicit = list(...)
    if explicit:
        return explicit          # <- the wave never got a look in

So the `wave` argument I added for #61 did nothing in the common case.
The webapp always sets `extra.payment_methods` from its payment-method
checkboxes, which means the explicit path is the normal one, not the
exception — three layers then disagreed:

- the NIP-52 tag advertised `tickets_payment_methods: lightning,fiat`
  while omitting `tickets_allow_fiat`, contradicting itself
- the checkout rendered a Card button
- `api_ticket_create`, the only wave-aware check, refused the purchase

Asking about a specific wave means asking what a buyer can actually use
for it, so a rail that wave cannot honour is now dropped. The
event-level question (no wave) still reports every rail the organiser
enabled — that is what `/republish-all` and the admin views want.

Fiat-only rails on a non-fiat wave now yield an empty list, which is
honest: nothing is purchasable from that wave.

5 tests, including both publisher shapes with an explicit list — the
case that actually bit, and which the #61 tests missed because their
fixtures left `payment_methods` empty. 133 pass.

Does not fix the data on events already created through the webapp:
their waves were saved with `allow_fiat` unset, so those waves genuinely
cannot take fiat until toggled. That is aiolabs/webapp's side.

models.py

@@ -224,6 +224,14 @@ def effective_payment_methods(
     """
     explicit = list(getattr(event.extra, "payment_methods", []) or [])
     if explicit:
+        # The organiser's rail list is event-level, but fiat is a per-wave
+        # opt-in. Asking about a specific wave means asking what a buyer can
+        # actually use for it, so drop a rail that wave cannot honour —
+        # otherwise the NIP-52 tag advertises fiat and the checkout offers a
+        # card button that `api_ticket_create` then refuses with "Fiat
+        # payments are not enabled for this ticket wave."
+        if wave is not None and not wave.allow_fiat:
+            return [method for method in explicit if method != "fiat"]
         return explicit
     methods = ["lightning"]
     if wave.allow_fiat if wave is not None else event.allow_fiat: