feat: attribute shop and locks receipts to the paying contact

[ovitrif]

Twin: synonymdev/bitkit-android#1387

Problem or use case

A creator who takes Shop or Locks payouts in Bitkit gets on-chain receipts without the payer. The activity row has no name, and the receipt is missing from the paying contact's activity page. A payment between the same two contacts made in Bitkit is named and listed there.

Bitkit Android showed this in a regtest run on 25 Sep. The iOS code takes the same path; not checked on an iOS device.

Proposed solution

• When an on-chain payment arrives at a server-derived address, Bitkit sets the contact who paid it, next to the reserved-address lookup.
• This needs the same Paykit Server change as the Android issue: the creator's wallet has no way to learn who a server-derived address was handed to. No Paykit Server issue exists yet. The server already derives each address for one reader (invoices.reader_lookup_hash, paykit-server/migrations/0001_initial.sql:41-49 on 722ef26), so it can hand the wallet the pair (address, reader pubky) when it derives the address, for example as a record the server writes for the wallet. Bitkit then looks the paying address up in those pairs.

Alternatives considered

• The payer's Bitkit tells the creator's wallet, over their existing wallet link, which transaction paid a server request. This needs no server change, but it relies on the payer's wallet reporting every payment.
• The creator assigns each receipt by hand with "Assign", which works today.

Additional context

Code on master (c5a2a05):

• Bitkit/Services/CoreService.swift:628-644: an inbound on-chain payment gets a contact only from an address reserved for a contact's private Paykit endpoint (:641-643; resolvers set in Bitkit/AppScene.swift:288-295):

  if contact == nil {
      contact = await privatePaykitContactPublicKey(forReservedAddress: address)
  }

• A Shop or Locks payment goes to an address the Paykit Server derives from the watch-only account that the x-bitkit-claim=watch-only-account-v1 setup creates (Bitkit/Models/PubkyAuthRequest.swift:5-9), so it never matches.
• The contact page lists activities by the same field: Bitkit/ViewModels/ActivityListViewModel.swift:281-283 calls coreService.activity.get(contact: publicKey, …).

Android pair: the synonymdev/bitkit-android issue with the same title.