refactor: Handle payjoin persisted errors and fallback

[ValeraFinebits]

Handle payjoin persisted errors and fallback

Merge after #148.

Atomic seen-input check. PayjoinSeenInputStore committed each inspected outpoint on its own,
so a failure partway through left inputs recorded with no matching session event and the retry of
the same proposal rejected itself against its own leftovers. ExecuteSeenInputTransition now
stages the callback's writes and flushes them with the single SaveChanges that appends the event.
The transaction stays implicit because the Npgsql context enables retry-on-failure, which refuses
user-initiated transactions.

Persisted errors. ReceiverPersistedException is caught and the stored session retained: the
exception cannot say what reached the database, so the next tick's replay decides.

ReceiverPendingFallback. The state a rejected proposal replays into previously fell through
the dispatch switch and polled until expiry; it is now closed explicitly, and
ProcessReplyableErrorAsync saves the transition that produces it.

Tests. Session retention/retry across Transient/Storage/Fatal failures, PendingFallback
dispatch, seen-input rollback and cross-session visibility. The same-wallet integration test now
asserts the proposal is rejected instead of waiting out the timeout.

[Copilot]

Pull request overview

Refactors receiver recovery, ownership checks, and seen-input persistence for safer Payjoin fallback handling.

Changes:

• Handles persisted errors and closes replayed pending fallbacks.
• Resolves input ownership by exact historical outpoints.
• Atomically persists seen inputs with receiver-session events.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
PayjoinWalletOwnershipService.cs	Adds outpoint-based ownership resolution.
PayjoinSeenInputStore.cs	Stages seen inputs with session transitions.
PayjoinReceiverStateProcessor.cs	Processes ownership, fallback, and atomic seen-input transitions.
PayjoinReceiverSessionProcessor.cs	Handles persisted errors and pending fallbacks.
PayjoinReceiverSessionGuard.cs	Restores original transaction facts during replay.
PayjoinAvailabilityService.cs	Documents cold-wallet readiness requirement.
IPayjoinReceiverStateProcessor.cs	Extends state-processing contracts and context.
Plugin.cs	Updates service construction.
UIStorePayjoinController.cs	Documents cold-wallet tracking limitations.
GreenfieldPayjoinController.cs	Documents cold-wallet tracking limitations.
PayjoinReceiverStateProcessorTests.cs	Tests ownership and transaction extraction.
PayjoinReceiverSessionProcessorTests.cs	Tests persistence failures and fallback dispatch.
RelationalPluginTestSupport.cs	Adds persistence-race test hooks.
PayjoinSettlementFlowTests.cs	Updates processor test implementation.
PayjoinReceiverSessionStoreRelationalTests.cs	Tests atomic seen-input persistence.
PayjoinWalletOwnershipIntegrationTests.cs	Tests historical and cold-wallet ownership.
PayjoinPluginIntegrationTests.cs	Verifies rejected-proposal fallback closure.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.