Build 43: real payment requests + incoming-requests opt-out

Wire GRIM's receiver-initiated invoice (Invoice1) over nostr so the Pay-tab
"Request" button actually asks someone for money: pick a contact, issue an
Invoice1, DM it; they get the existing approve-to-pay card. New
WalletTask::NostrRequest mirrors NostrSend (issue_invoice + RequestedByUs /
AwaitingI2, reusing send_payment_dm); the send flow gains a request mode
(Request from -> Confirm request -> Send request -> Requested) with no balance
guard, since requesting isn't spending.

Incoming requests are now opt-out (Settings -> Requests, on by default): when
off, an incoming Invoice1 is dropped and the preference is advertised in the
kind-0 profile (goblin_accepts_requests) so a requester sees "Could not
request" before sending. Adds a Cash App-style toggle switch widget.

Also enlarge the center Pay puck in the floating nav, and make the macOS
release build recur: release.yml now triggers on release publish (macOS only,
since Linux/Windows/Android/AppImage are built locally).

.github/workflows/release.yml

@@ -8,6 +8,12 @@
 name: Release
 
 on:
+  # Auto-build on every published release so macOS — which can't be built on the
+  # Linux release box — is produced for each build without manual steps. The
+  # Linux/Windows jobs are gated to manual dispatch only (those are built locally
+  # and uploaded with the release), so a publish event builds just macOS.
+  release:
+    types: [published]
   workflow_dispatch:
     inputs:
       tag:
@@ -18,16 +24,18 @@ permissions:
   contents: write
 
 env:
-  TAG: ${{ inputs.tag }}
+  TAG: ${{ inputs.tag || github.event.release.tag_name }}
 
 jobs:
   linux:
     name: Linux x86_64
     runs-on: ubuntu-latest
+    # Built locally and uploaded with the release; only run on manual dispatch.
+    if: github.event_name == 'workflow_dispatch'
     steps:
       - uses: actions/checkout@v6
         with:
-          ref: ${{ inputs.tag }}
+          ref: ${{ inputs.tag || github.event.release.tag_name }}
           submodules: recursive
       - name: Build
         run: cargo build --release
@@ -37,7 +45,7 @@ jobs:
           sha256sum "goblin-$TAG-linux-x86_64.tar.gz" > "goblin-$TAG-linux-x86_64-sha256sum.txt"
       - uses: softprops/action-gh-release@v2
         with:
-          tag_name: ${{ inputs.tag }}
+          tag_name: ${{ inputs.tag || github.event.release.tag_name }}
           files: |
             goblin-${{ inputs.tag }}-linux-x86_64.tar.gz
             goblin-${{ inputs.tag }}-linux-x86_64-sha256sum.txt
@@ -45,10 +53,12 @@ jobs:
   windows:
     name: Windows x86_64 (MSVC)
     runs-on: windows-latest
+    # Built locally and uploaded with the release; only run on manual dispatch.
+    if: github.event_name == 'workflow_dispatch'
     steps:
       - uses: actions/checkout@v6
         with:
-          ref: ${{ inputs.tag }}
+          ref: ${{ inputs.tag || github.event.release.tag_name }}
           submodules: recursive
       - name: Build
         run: cargo build --release
@@ -59,7 +69,7 @@ jobs:
           sha256sum "goblin-$TAG-win-x86_64.zip" > "goblin-$TAG-win-x86_64-sha256sum.txt"
       - uses: softprops/action-gh-release@v2
         with:
-          tag_name: ${{ inputs.tag }}
+          tag_name: ${{ inputs.tag || github.event.release.tag_name }}
           files: |
             goblin-${{ inputs.tag }}-win-x86_64.zip
             goblin-${{ inputs.tag }}-win-x86_64-sha256sum.txt
@@ -70,7 +80,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
-          ref: ${{ inputs.tag }}
+          ref: ${{ inputs.tag || github.event.release.tag_name }}
           submodules: recursive
       - name: Build both architectures
         run: |
@@ -86,7 +96,7 @@ jobs:
           shasum -a 256 "goblin-$TAG-macos-universal.zip" > "goblin-$TAG-macos-universal-sha256sum.txt"
       - uses: softprops/action-gh-release@v2
         with:
-          tag_name: ${{ inputs.tag }}
+          tag_name: ${{ inputs.tag || github.event.release.tag_name }}
           files: |
             goblin-${{ inputs.tag }}-macos-universal.zip
             goblin-${{ inputs.tag }}-macos-universal-sha256sum.txt