Update spec and readme

backend/spec/models.md

@@ -24,6 +24,7 @@ Activity is an audit log of all actions performed by a user or a worker process.
   - `update_relay`
   - `activate_relay`
   - `deactivate_relay`
+  - `mark_relay_delinquent`
   - `fail_relay_sync`
   - `complete_relay_sync`
 - `resource_type` is a string identifying the resource type being modified.
@@ -35,7 +36,7 @@ A plan represents a rate charged for relays at a given feature/usage limit. Plan
 
 - `id` - the plan slug
 - `name` - the plan name
-- `amount` - the plan monthly cost in USD
+- `amount` - the plan's monthly cost in USD minor units (cents); e.g. `500` for $5/mo
 - `members` - the max number of members a relay can have before needing to upgrade. If empty, membership is not limited.
 - `blossom` - whether blossom media hosting is available on this plan
 - `livekit` - whether livekit audio/video calls are available on this plan
@@ -52,7 +53,7 @@ There are three plans available:
 Tenants are customers of the service, identified by a nostr `pubkey`. Public metadata like name etc are pulled from the nostr network. They also have associated billing information.
 
 - `pubkey` is the nostr public key identifying the tenant
-- `nwc_url` (private) a nostr wallet connect URL used for **paying** invoices generated by the system on the tenant's behalf; stored encrypted at rest using NIP-44 via `ENCRYPTION_SECRET`; never serialized to API responses — tenant API endpoints expose `nwc_is_set: bool` instead
+- `nwc_url` (private) a nostr wallet connect URL used for **paying** invoices generated by the system on the tenant's behalf; stored encrypted at rest using NIP-44 with the robot key (`ROBOT_SECRET`, via `Env::encrypt`); never serialized to API responses — tenant API endpoints expose `nwc_is_set: bool` instead
 - `nwc_error` (private) a string indicating the most recent NWC payment error, if any. Cleared on successful NWC payment.
 - `created_at` unix timestamp identifying tenant creation time
 - `stripe_customer_id` a string identifying the associated stripe customer
@@ -63,7 +64,7 @@ Tenants are customers of the service, identified by a nostr `pubkey`. Public met
 
 A relay is a nostr relay owned by a `tenant` and hosted by the attached zooid instance. Relay subdomains MUST be unique.
 
-- `id` - calculated based on `subdomain` + 8 random hex chars
+- `id` - calculated based on `subdomain` (with `-` replaced by `_`) + `_` + 8 random hex chars
 - `tenant` - the tenant's pubkey
 - `schema` - the relay's db schema (read only, same as `id`)
 - `subdomain` - the relay's subdomain
@@ -89,3 +90,15 @@ Some attributes persisted to zooid via API have special handling:
 - The value of `inactive` is calculated based on `status`
 - The relay's `livekit_*` configuration is inferred based on environment variables and `livekit_enabled`.
 - The relay's `roles` are hard-coded for now.
+
+# LightningInvoice
+
+Tracks the bolt11 invoice issued on the system wallet to collect a single Stripe invoice over Lightning (either NWC auto-pay or a manual payment from the app). One row per Stripe invoice.
+
+- `stripe_invoice_id` - the Stripe invoice this bolt11 collects (primary key)
+- `tenant_pubkey` - the owning tenant
+- `bolt11` - the bolt11 invoice string issued on the system wallet
+- `status` - one of `pending|paid`
+- `paid_method` (nullable) - how it settled, one of `nwc|manual`; set when `status` becomes `paid`
+- `expires_at` - unix timestamp after which the `pending` bolt11 is considered expired and may be regenerated
+- `created_at` / `updated_at` - unix timestamps