nwc: budget keysend, atomic dedup, serialize spends (S4/S6/S8)

- pay_keysend never called checkBudget and never recorded to
  ${pubkey}:payments, so a budget-limited connection string was a
  full-drain credential. Budget-check it, honor max_fee, and record the
  debit so subsequent budgeted calls count it (S4).
- Replace the non-atomic zScore-then-(unawaited)-zAdd dedup with an
  awaited SET NX claim, so two concurrent deliveries of the same signed
  event can't both reach handle() and pay twice; also reject
  future-dated created_at beyond a small skew (S6).
- Serialize budget-affecting methods per app with an async mutex so a
  concurrent request can't read a stale spent-total and overspend (S8).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

0 files changed, 0 insertions, 0 deletions