feat(models): settle_transaction op, alerts_pubkey, operator_notified_at (m017)

ADR-005 §6 groundwork. settle_transaction is a machine-wide op like
resume_cash_out; it carries the machine txid it closes and the operator's
provenance note. super_config.alerts_pubkey overrides where owed-cash
alerts go; dca_settlements.operator_notified_at stops a report resend
from re-alerting.

migrations.py

@@ -1020,3 +1020,29 @@ async def m016_dispense_outcome(db):
         await db.execute(
             f"ALTER TABLE spirekeeper.dca_machines ADD COLUMN {col} {typ}"
         )
+
+
+async def m017_owed_cash_closure(db):
+    """ADR-005 §6 — closing an owed-cash settlement, and telling the operator.
+
+    `operator_notified_at`: when the Nostr alert for a cash_owed /
+    partial_pending settlement went out (NIP-17 DM to the operator). Kept so
+    a report resend never re-alerts and the dashboard can show that the
+    operator was told.
+
+    `super_config.alerts_pubkey`: optional recipient override. By default the
+    alert goes to the operator's own LNbits-account pubkey (a note to self,
+    readable in any NIP-46 client); operators who want it on a phone identity
+    set this.
+
+    `cassette_ops.txid` / `.note`: the machine-wide `settle_transaction` op —
+    the operator paid the customer by hand, outside the machine — carries the
+    machine txid it closes and the provenance note, so the machine can flip its
+    own row to `remediated` and both ledgers close on one act.
+    """
+    await db.execute(
+        "ALTER TABLE spirekeeper.dca_settlements ADD COLUMN operator_notified_at TIMESTAMP"
+    )
+    await db.execute("ALTER TABLE spirekeeper.super_config ADD COLUMN alerts_pubkey TEXT")
+    await db.execute("ALTER TABLE spirekeeper.cassette_ops ADD COLUMN txid TEXT")
+    await db.execute("ALTER TABLE spirekeeper.cassette_ops ADD COLUMN note TEXT")