Stop the nostr sync snapshot from importing another ASP's coins

The phantom balance came back through the sync path. Snapshots published by
older builds carry no ASP tag, so the tag check passed them, and with the
local namespace empty the merge returned the snapshot wholesale — writing
second.tech's vtxos straight into the coinos namespace, where the manager
then stamped them as coinos'.

Two fixes, both grounded in the fact that a vtxo names its own cosigner:
- the sync path derives the snapshot's true owner from its vtxos and parks it
  under that owner instead of merging when it isn't provably ours
- ArkManager.init drops any state whose coins were cosigned by a different
  server, whatever the stamp claims. Stamps are something we wrote; the vtxo
  bytes are evidence.

Found by tracing localStorage reads in the live tab: the namespaced key was
being *created* during load, which pointed at the merge rather than at
storage keying.

Co-Authored-By: Claude Fable 5 <[email protected]>

0 files changed, 0 insertions, 0 deletions