[kwsantiago]

Adds two read-only utility commands.

decode (closes #10)

Decodes a NIP-19 bech32 entity (or bare hex pubkey) into its underlying fields, one label value line per field:

• npub/nsec/note -> hex pubkey / seckey / id
• nprofile/nevent/naddr (and noffer/ndebit/nmanage) -> pubkey/id/kind/identifier plus any embedded relay hints
• bare 64-char hex -> echoed as pubkey

Backed by bech32.decodeNostr. Undecodable input prints invalid: ... and exits non-zero.

verify (closes #11)

Reads an event from an arg or stdin, recomputes its id from the canonical NIP-01 form, confirms it matches the id field, and verifies the Schnorr signature. Prints valid, or invalid: <reason> and exits non-zero on id mismatch, bad signature, malformed JSON, or a far-future created_at. Backed by Event.validate.

noz event -c hi -k 1 --sec <key> | noz verify   # valid
noz decode npub10elfcs4fr0l0r8af98jlmgdh9c8tcxjvz9qkw038js35mp4dma8qzvjptg

Verified manually against NIP-19 test vectors (npub/nsec/note/nprofile) and round-tripped signed events (valid, tampered content -> id mismatch, tampered sig -> sig mismatch, malformed -> error). zig build and zig build test pass.

Follow-up: encode (#12) and fetch (#13).