Add Ark <-> Lightning via the ASP (captaind-native submarine swaps)

The ASP is the HTLC counterparty (second.tech's protocol), so no external
swap provider is needed: paying a bolt11 converts pubkey vtxos into
ServerHtlcSend vtxos the server can only claim by revealing the invoice
preimage; receiving grants ServerHtlcRecv vtxos claimed by revealing ours.
Failure paths cosign the HTLC back (revocation) — proven end-to-end against
regtest captaind, which independently derives the HTLC taproots.

- ark/lightning.js: bolt11 decode, lightning fee schedules, all pay/receive
  gRPC-web wrappers (cosign, initiate, status, revocation, hold-invoice
  receive flow, anti-DoS attestation)
- ark/send.js: arkoor builder generalized to policy outputs (pubkey /
  serverHtlcSend / serverHtlcRecv), two-leaf taproot trees, HTLC clause
  scripts, reusable per-part cosign helpers for package RPCs
- ark/manager.js: ln-pay and ln-recv crash-safe action state machines
  (deterministic receive preimages from the seed, chain 5), mailbox
  lightning notifications, unpayable-invoice -> instant revocation
- proto.js: lightning ArkInfo fields + mailbox lightning message decode
- validate/refresh: policy-aware vtxo validation and reconstruction
- features: bolt11 routes via ark when the balance covers it (Boltz stays
  the fallback), lightning-invoice receive on the Ark pane
- tools/ark/ln-test.js: harness proving HTLC cosign + revocation against
  captaind; manager-test.js updated for the consolidated bc-container chain

Co-Authored-By: Claude Fable 5 <[email protected]>

1 files changed, 4 insertions, 2 deletions

diff --git a/src/ark/validate.js b/src/ark/validate.js
index d80ba50..f7aecb9 100644
--- a/src/ark/validate.js
+++ b/src/ark/validate.js
@@ -22,11 +22,13 @@ const fail = (msg) => { throw new VtxoValidationError(msg); };
 
 // chain: an object with getTxHex(txid) -> hex|null and tipHeight() -> number,
 // plus getTxStatus(txid) -> {confirmed, block_height} (esplora semantics)
-export async function validateVtxo(vtxo, { serverPubkey, chain, expectPubkeys }) {
+// allowPolicies: acceptable policy types (default plain pubkey only; lightning
+// flows pass ['serverHtlcSend'] / ['serverHtlcRecv'] for their HTLC vtxos)
+export async function validateVtxo(vtxo, { serverPubkey, chain, expectPubkeys, allowPolicies = ['pubkey'] }) {
   const serverHex = hex.encode(serverPubkey);
 
   // -- structural --
-  if (vtxo.policy.type !== 'pubkey') fail(`unsupported policy: ${vtxo.policy.type}`);
+  if (!allowPolicies.includes(vtxo.policy.type)) fail(`unsupported policy: ${vtxo.policy.type}`);
   if (vtxo.serverPubkey !== serverHex) fail('vtxo server pubkey does not match ours');
   if (expectPubkeys && !expectPubkeys.includes(vtxo.policy.userPubkey)) {
     fail('vtxo not paid to one of our keys');