payments: use the debited tip when crediting internal transfers

credit() now credits the tip the sender was actually debited (passed in
by the internal-transfer callers) instead of independently re-reading the
invoice. This closes a time-of-check/time-of-use gap where an invoice's
tip could be changed between the sender debit and the receiver credit,
letting a payer be credited a tip they were never charged.

External receipts (lightning/ecash) keep reading the invoice tip, since
there is no paired coinos debit to diverge from.

Also harden POST /invoice/:id: validate the tip is a sane non-negative
integer and reject tip changes on an already-settled invoice.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

0 files changed, 0 insertions, 0 deletions