feat(forms): validate submitter npub on submission forms (#22)

The embed submission forms accepted any free-text identifier and published it,
so they were an easy spam vector. Add a shared, testable NIP-19 validator and
require a well-formed npub before a submission is sent.

- js/utils/validateNpub.js: validateNpubHex() decodes via nostr-tools nip19 and
  returns the 64-char hex pubkey, or null for anything that isn't a real npub
  (free text, wrong prefix, bad checksum, wrong NIP-19 entity). Also exposed as
  window.validateNpubHex for the classic iframe form scripts.
- Application form (required npub): submit is blocked unless valid; the decoded
  hex is written into the application body for canonical storage/matching.
- Feature-request / bug-fix / feedback (optional npub): stays optional, but a
  non-empty value must be a valid npub or submit is blocked with an inline error.
- Tests: tests/validate-npub.test.mjs (real nostr-tools, no implementation mirror).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

components/iframe_forms/iframe-request-form.html

@@ -8,6 +8,8 @@
     <link rel="stylesheet" href="../../css/tailwind.generated.css" />
     <!-- Load nostr‑tools v2.17.0 -->
     <script src="https://cdn.jsdelivr.net/npm/[email protected]/lib/nostr.bundle.min.js"></script>
+    <!-- Shared anti-spam npub validation (sets window.validateNpubHex) -->
+    <script type="module" src="../../js/utils/validateNpub.js"></script>
   </head>
   <body class="iframe-form" data-ds="new">
     <div class="container">
@@ -235,6 +237,21 @@
             try {
               // Section 1: User Information
               const userNpub = document.getElementById("userNpub").value.trim();
+
+              // Anti-spam: npub is optional here, but if provided it must be a
+              // valid npub so the submission can't carry free-text garbage.
+              if (
+                userNpub &&
+                (typeof window.validateNpubHex !== "function" ||
+                  !window.validateNpubHex(userNpub))
+              ) {
+                log(
+                  "That Nostr public key isn't valid. Enter a valid npub1… or leave it blank. Your submission was not sent.",
+                  "error"
+                );
+                document.getElementById("userNpub")?.focus();
+                return;
+              }
               const roleNodes = document.querySelectorAll(
                 'input[name="userRole"]:checked'
               );