fix: prevent duplicate zap counting from race conditions

[barrydeen]

Summary

• EventRepository: Wrap countedZapIds get-or-create in a synchronized block to prevent concurrent collectors (e.g. thread-reactions + notif) from creating separate dedup sets for the same target, causing zaps to be double-counted
• NotificationRepository: Add secondary event ID tracking in mergeZap to guard against LRU eviction in seenEvents allowing the same 9735 event to be re-processed on periodic refresh cycles — unlike mergeReaction which already has inner pubkey dedup, mergeZap was blindly appending

Test plan

• Send a zap and verify the count increments by 1, not 2+
• Check notifications after a few minutes of usage — zap entries should not duplicate
• View a thread containing a zapped post while notifications are active — no double counting