LIR: persist & bilaterally sign the Sponsoring LIR Agreement

[v0l]

Part of the LIR sponsoring epic (see #39).

The Sponsoring LIR Agreement is already generated and provider-signed (api/legal.rs + legal/Sponsoring_LIR_Agreement.html, with a Nostr cryptographic proof). But as built it is not compliant/enforceable:

1. Provider-only — only our nsec signs; the End Users signatory fields are placeholders. A contract needs bilateral assent.
2. Not persisted — the signed agreement is only base64-encoded into a URL; nothing is stored. RIPE requires the executed contract on file for ARC audits.
3. No identity binding — see the KYC issue (LIR: End-User KYC via Stripe Identity #188).

Scope

• lir_agreement table: subscription_id, document_reference, kyc_record_id (from LIR: End-User KYC via Stripe Identity #188), provider npub/event id/sig, end_user npub/event id/sig, signed_document_hash, signed_json, resources snapshot, created_at. Migration + model + DB + mock.
• Bilateral signing: capture the End Users Nostr signature over a hash of the final rendered agreement (explicit consent intent + timestamp), in addition to the providers.
• Persist the fully-executed agreement; expose a retrieval endpoint (owner + admin) that re-renders from the stored record.
• Link asn_subscription / ip_range_subscription to the agreement so each sponsored resource points to its contract.
• (Optional) qualified timestamp on the signature for stronger evidentiary weight.

Notes

• Sign a document hash with clear intent, not a bare Kind:1 note of the JSON.
• Gate is enforced separately (fulfilment must require verified KYC + a fully-signed agreement).
• Not legal advice — confirm eIDAS signature tier (Simple vs Advanced) and RIPE acceptance with counsel/RIPE NCC.

Depends on: #188 (KYC identity binding).