feat(nostr): confirm publishes against the relay's OK

`publish_nostr_event` returned as soon as the EVENT was on the send
queue, and the publisher logged "Published" on the next line. Queueing
is not delivery: nostrclient drops an EVENT outright when no relay is
connected, answering `OK false "error: no relays connected"`. We threw
that reply away.

On cfaun this cost a completed repair. The #55 sweep republished a
14-day-stale calendar event 21 seconds before nostrclient had finished
connecting to its relay, got `OK false`, logged `Published`, reported
`1/1 recovered` and cleared `nostr_publish_pending` — leaving the count
stale, the row unflagged and the log asserting success. It took a
manual re-arm of the flag to finish the job.

So the flag's contract was never true: it claimed to clear only on a
confirmed success but cleared on a confirmed enqueue.

`publish_nostr_event` now registers a future per event id, awaits the
`OK`, and returns whether it was accepted. `publish_event_to_nostr`
returns None when unconfirmed, which keeps the row flagged so the sweep
retries rather than recording a delivery that never happened.

Correlation lives in `get_event`, the one place relay messages cross
from the websocket thread into the event loop — no cross-thread future
juggling. OK frames are consumed there rather than forwarded; the sync
loop never handled them. A disconnect settles every in-flight publish
immediately instead of making callers wait out the timeout.

On latency: the timeout is not the common cost. A disconnected relay is
rejected by nostrclient's router in milliseconds (230ms measured on
aio-demo), so the 12s budget only applies when relays are connected but
silent, which nostrclient itself bounds at 10s. `set_ticket_paid` runs
on the invoice-listener task, so that narrow case does stall the loop;
if it ever matters, the remedy is to stop awaiting on the sale path
while leaving the flag set — the sweep already guarantees eventual
delivery — not to go back to reporting unverified success.

Closes #56

nostr_publisher.py

@@ -203,7 +203,16 @@ async def publish_event_to_nostr(
         nostr_event.pubkey = signed["pubkey"]
         nostr_event.sig = signed["sig"]
 
-        await nostr_client.publish_nostr_event(nostr_event)
+        accepted = await nostr_client.publish_nostr_event(nostr_event)
+        if not accepted:
+            # Returning None keeps `nostr_publish_pending` set, so the
+            # sweep retries instead of recording a delivery that never
+            # happened (aiolabs/events#56).
+            logger.warning(
+                f"[EVENTS] Relay did not confirm NIP-52 "
+                f"{'delete' if delete else 'calendar'} event for {event.id}"
+            )
+            return None
 
         logger.info(
             f"[EVENTS] Published NIP-52 {'delete' if delete else 'calendar'} "