docs: NOSTR.md accuracy pass — verified against every line of code

[tlongwell-block]

Summary

Accuracy pass on NOSTR.md — every claim verified against source code. Four discrepancies fixed.

Changes

#	Fix	Evidence
1	MySQL→Postgres — mysql/UNHEX/HEX → psql/decode/encode with PGPASSWORD and -h localhost	docker-compose.yml runs postgres:17-alpine; .env.example uses PGPASSWORD=sprout_dev
2	kind:9021 promoted — moved from "What Doesn't Work" to "What Works"	side_effects.rs:1053 has full handler: adds member, emits system message + discovery + kind:44100
3	Error message fixed — old doc had wrong string and missed kind:1059 scope	req.rs:126 actual string; P_GATED_KINDS covers 44100, 44101, and 1059
4	Subscription constraint scope — expanded from "kind:44100/44101" to all p-gated kinds	req.rs:104 — P_GATED_KINDS array includes gift wraps

Details

1. MySQL→Postgres SQL syntax (lines 37, 95–97)

Quick Start and Pubkey Allowlist sections used mysql CLI with UNHEX()/HEX(). The database is Postgres 17 (docker-compose.yml). Fixed to psql with proper connection flags matching .env.example conventions:

-mysql -u sprout -psprout_dev sprout -e \
-  "INSERT INTO pubkey_allowlist (pubkey) VALUES (UNHEX('<64-char-hex-pubkey>'))"
+PGPASSWORD=sprout_dev psql -h localhost -U sprout -d sprout -c \
+  "INSERT INTO pubkey_allowlist (pubkey) VALUES (decode('<64-char-hex-pubkey>', 'hex'))"

This was originally proposed in #220 (closed without merge). Follow-up PRs #233–#237 covered other docs but missed NOSTR.md.

2. kind:9021 (Join request) — fully implemented, not deferred

Was listed as "deferred (no-op with warning log)" in "What Doesn't Work". The code tells a different story:

• side_effects.rs:54 dispatches to handle_join_request() (line 1053)
• Handler adds member, emits system message, emits group discovery events, emits kind:44100 notification
• ingest.rs:1031 rejects private channels at ingest
• Only kind:9009 (create invite) remains deferred

3. Error message and p-gated scope

Doc said "restricted: membership notifications require #p matching your pubkey" but:

• Actual code string (req.rs:126): "restricted: p-gated events require #p matching your pubkey"
• P_GATED_KINDS (req.rs:104) = [44100, 44101, 1059] — includes gift wraps, not just membership notifications

4. Architecture section consistency

Updated admin command list from "deferred 9009, 9021" to "deferred 9009" — consistent with change 2.

Review

Crossfire reviewed by Codex (GPT-5.4) and Claude Opus against source code:

Reviewer	Score	Verdict
Codex	10/10	APPROVE
Opus	9/10	APPROVE

Both confirmed all changes match the implementation. No other inaccuracies found in full-document scan.