feat(pairing,ui): optional machine_npub + bunker_relay override + fee decimal-input UX

Three changes from the nsecbunkerd#27 bunker-pairing smoke (validated
end-to-end on the Sintra, 2026-06-21); intermingled per-file, so landed
together.

1. Optional machine_npub (model A1) — register UNPAIRED, bunker mints the
   identity at pairing:
   - machine_npub now nullable (migration m011 rebuilds dca_machines for
     sqlite / ALTER ... DROP NOT NULL for postgres; UNIQUE stays, NULLs
     don't collide so any number of unpaired machines coexist).
   - CreateMachineData.machine_npub -> str | None; create skips the
     collision-check + fee publish when blank; api_pair_machine now
     publishes the fee config after minting, so an unpaired machine clears
     its awaiting-fees gate once paired.
   - Supplying an npub up front is the DEVELOPMENT self-key path (a machine
     holding its own signing key) — available to anyone but the form field
     is explicitly marked DEVELOPMENT ONLY.
   - Frontend: npub field optional, required rule dropped, null-safe
     display (shortNpub -> "unpaired", guarded slices), empty -> null.

2. bunker_relay override on POST /machines/{id}/pair: PairMachineData gains
   bunker_relay; api_pair_machine threads it to pair_spire. Lets the seed's
   bunker:// relay differ from the relay lnbits uses to reach the bunker
   (internal docker host vs LAN/public) — needed for split-relay / dev
   deploys. Without it the smoke had to mint via a script.

3. Fees are decimal fractions, not percents: relabel super + operator fee
   inputs ("decimal fraction, 0-0.15") + a shared _assertFeesDecimal()
   guard (super/add/edit submits) so a percent typo (3 instead of 0.03)
   gets a clear toast, not a raw 400.

refs: nsecbunkerd#27/#36; aiolabs/bitspire#52; coordination smoke 2026-06-21

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

models.py

@@ -28,7 +28,11 @@ class CreateMachineData(BaseModel):
     not against any fee total. See aiolabs/satmachineadmin#37 / #38.
     """
 
-    machine_npub: str
+    # Optional: blank = register the machine UNPAIRED — the bunker mints its
+    # identity at pairing (model A1, the normal path). Supplying an npub here
+    # is the development self-key path (a machine that holds its own signing
+    # key); see views_api.api_create_machine.
+    machine_npub: str | None = None
     wallet_id: str
     name: str | None = None
     location: str | None = None
@@ -48,7 +52,7 @@ class CreateMachineData(BaseModel):
 class Machine(BaseModel):
     id: str
     operator_user_id: str
-    machine_npub: str
+    machine_npub: str | None  # NULL until paired (or supplied on the dev self-key path)
     wallet_id: str
     name: str | None
     location: str | None
@@ -84,11 +88,17 @@ class UpdateMachineData(BaseModel):
 class PairMachineData(BaseModel):
     """Body for POST /machines/{id}/pair (S0 / #9). `relays` are the relays
     the spire will use for its own events (kind-21000/30078) — typically the
-    operator's nostrrelay; the bunker connection relay is added separately
-    from the lnbits bunker settings. `duration_hours` optionally time-bounds
-    the spire's connect token (None = non-expiring)."""
+    operator's nostrrelay. `bunker_relay` overrides the relay embedded in the
+    seed's `bunker://` URL (the relay the spire uses to *reach* the bunker);
+    when omitted it defaults to `settings.lnbits_nsec_bunker_url`. Set it when
+    the relay lnbits uses to reach the bunker differs from the one the spire
+    must reach — e.g. an internal docker hostname (`ws://lnbits:5001/…`) vs a
+    LAN/public URL (`ws://192.168.0.32:5001/…`), or any split-relay deploy.
+    `duration_hours` optionally time-bounds the spire's connect token
+    (None = non-expiring)."""
 
     relays: list[str]
+    bunker_relay: str | None = None
     duration_hours: int | None = None
 
     @validator("duration_hours")