docs: dev plan for bitvid-native, preimage-verified zap tally (#47)

Full spec for making Most Zapped + zap badges global/durable/cross-user
without depending on external wallets to publish NIP-57 receipts (which
custodial providers like Strike don't). Key insight: the payer holds the
preimage after NWC pay_invoice, and the invoice's description hash commits
to the zap request's pointer+amount — so a payer-signed event carrying
{zapRequest, bolt11, preimage} is verifiable with the same cryptographic
strength as a recipient-signed 9735, reusing bitvid's existing bolt11 decode
in zapReceiptValidator.js.

docs/zap-tally-plan.md covers: the event schema, the verify algorithm,
cross-source dedup by payment_hash (9735-preferred), file-by-file code
changes, security/edge cases, a feature-flagged rollout, a test plan, open
decisions, and an ordered task checklist so the build stays neat across
sessions. TODO #47 points at it. No code changes yet.

Co-Authored-By: Claude Fable 5 <[email protected]>

todo/TODO_2026-06-20_pre-launch.md

@@ -615,6 +615,19 @@ toward freshness and looked identical. Gave each a structural identity:
       handled).
 
 ### 47. "Most Zapped" sidebar tab (trending-by-zaps)
+- [ ] **NEXT (planned, not started): bitvid-native zap tally.** Full spec +
+      ordered task checklist in `docs/zap-tally-plan.md`. Problem: NIP-57 zap
+      receipts (9735) are published by the RECIPIENT's LNURL server, and
+      custodial wallets (Strike) don't — so paid zaps leave no on-relay record
+      and can't be counted globally. Fix: bitvid publishes a payer-signed,
+      preimage-verified zap event on successful send (as strong as a 9735 via
+      the preimage→payment_hash + description_hash→zapRequest binding, reusing
+      the existing bolt11 decode in `zapReceiptValidator.js`), counted alongside
+      real 9735s (deduped by payment_hash, 9735-preferred). Behind
+      `FEATURE_ZAP_TALLY` (default off). See the plan for the file-by-file
+      changes. Current state (commit `cbc62306`): 9735 counting + optimistic
+      bump + durable local ledger (`bitvid:sentZaps:v1`) already shipped; the
+      tally is the missing global/cross-user source.
 - [x] **DONE 2026-07-03.** Full Trending-pattern clone ranked by SATS:
         - `js/zapTotals.js` — per-pointer kind-9735 aggregation. The feed's
           getZapTotal reads the cached total AND schedules a BATCHED one-shot