fix(#26): FK constraints, trust scoring completeness, trust_tier always returned

- sessions.ts / jobs.ts schema: add .references(() => nostrIdentities.pubkey) FK constraints
  on nostrPubkey columns; import without .js extension for drizzle-kit CJS compat
- Schema pushed to DB (FK constraints now enforced at DB level)
- sessions route: call getOrCreate before insert to guarantee FK target exists;
  recordFailure now covers both 'rejected' AND 'failed' final states
- jobs route: call getOrCreate before insert; recordFailure added in
  runEvalInBackground for rejected and failed states; recordFailure added in
  runWorkInBackground catch block for failed state
- All GET/POST endpoints now always return trust_tier (anonymous fallback)
- Full typecheck clean; schema pushed; smoke tested — all routes green

lib/db/src/schema/jobs.ts

@@ -1,6 +1,7 @@
 import { pgTable, text, timestamp, integer, real } from "drizzle-orm/pg-core";
 import { createInsertSchema } from "drizzle-zod";
 import { z } from "zod/v4";
+import { nostrIdentities } from "./nostr-identities";
 
 export const JOB_STATES = [
   "awaiting_eval_payment",
@@ -36,8 +37,8 @@ export const jobs = pgTable("jobs", {
   actualOutputTokens: integer("actual_output_tokens"),
   actualCostUsd: real("actual_cost_usd"),
 
-  // Optional Nostr identity bound at job creation
-  nostrPubkey: text("nostr_pubkey"),
+  // Optional Nostr identity bound at job creation (FK → nostr_identities.pubkey)
+  nostrPubkey: text("nostr_pubkey").references(() => nostrIdentities.pubkey),
 
   // ── Post-work honest accounting & refund ─────────────────────────────────
   actualAmountSats: integer("actual_amount_sats"),

lib/db/src/schema/sessions.ts

@@ -1,6 +1,7 @@
 import { pgTable, text, timestamp, integer, boolean, real } from "drizzle-orm/pg-core";
 import { createInsertSchema } from "drizzle-zod";
 import { z } from "zod/v4";
+import { nostrIdentities } from "./nostr-identities";
 
 // ── Session state machine ─────────────────────────────────────────────────────
 
@@ -43,8 +44,8 @@ export const sessions = pgTable("sessions", {
   // Auth token — issued once when session activates; required for requests
   macaroon: text("macaroon"),
 
-  // Optional Nostr identity bound at session creation
-  nostrPubkey: text("nostr_pubkey"),
+  // Optional Nostr identity bound at session creation (FK → nostr_identities.pubkey)
+  nostrPubkey: text("nostr_pubkey").references(() => nostrIdentities.pubkey),
 
   // TTL — refreshed on each successful request
   expiresAt: timestamp("expires_at", { withTimezone: true }),