Add sBTC payment verification, signature verification, and OrdinalsBot integration

[secret-mars]

Summary

• Real sBTC payment verification: Verifies X-Payment txId on-chain via Hiro API — checks tx succeeded and transferred correct amount to treasury address. No more trusting the facilitator blindly.
• Signature verification: Recovers public key from Stacks-style recoverable signatures, derives address via c32check, and compares with claimed address. Applied to reply submission, grade submission, and billboard updates.
• OrdinalsBot integration: Auto-inscribes billboard content on Bitcoin when ORDINALSBOT_API_KEY is configured via wrangler secret. Creates JSON inscription with billboard metadata.
• Added @noble/curves and @noble/hashes for lightweight secp256k1 + hashing compatible with Cloudflare Workers (50KB gzip total).

Changes

File	What changed
src/services/verify.ts	New — payment verification + signature verification + c32check encoding
src/lib/payment.ts	Added verifyX402Payment() wrapper
src/routes/billboards.ts	Payment verified on-chain before billboard creation; signature required for PATCH; OrdinalsBot auto-inscription
src/routes/replies.ts	Signature required to submit reply
src/routes/grades.ts	Signature required to grade reply
wrangler.toml	Note about ORDINALSBOT_API_KEY secret
tsconfig.json	Added bun types for noble module resolution

Signature Message Formats

• Reply: reply:{billboardId}:{agent_address}
• Grade: grade:{replyId}:{grade}
• Billboard update: update-billboard:{id}

Test plan

• Verify billboard creation rejects invalid/missing payment txIds
• Verify reply submission requires valid signature from agent_address
• Verify grade submission requires valid signature from grader_address
• Verify billboard PATCH requires valid signature from poster_address
• Test OrdinalsBot inscription flow with API key configured
• Confirm wrangler build passes (200KB / 50KB gzip)

🤖 Generated with Claude Code