feat(nut18): pay and validate payment requests end to end

[robwoodgate]

Stacked on #780 (targets its head branch, so the diff shows only this PR's commits).
Retarget to main when #780 merges, last commit of 780 was c864ea5

Summary

Closes the gap between documenting the NUT-18 payer/receiver rules and enforcing them. Until now the docs choreographed four separate steps (mint-list check, melt-method check, amountToSend, includeFees(true)); a wallet that skipped one could underpay the receiver or violate a spec MUST silently.

Payer side: wallet.ops.sendToRequest(pr, proofs, amount?) builds a send that enforces the request in one step:

• strict mint list (URL-normalized membership)
• unit rule (request unit must match the wallet)
• NUT-05 melt-method support for the request unit, resolved from the wallet's own MintInfo (callers never pass method strings, so the mint-vs-melt and unit-binding mistakes are unrepresentable)
• lowest applicable per-method fee (mf), waived for listed mints
• the request's nut10 lock via asP2PK, throwing on kinds it cannot express (an exotic lock would otherwise send unlocked)
• net-of-input-fees selection (includeFees(true))

It returns the normal SendBuilder, so output types, keysets and offline modes chain as usual. Amountless requests take the payer-chosen amount as the third argument.

Receiver side: wallet.isPaymentRequestSatisfied(pr, proofs, expectedAmount?) checks sum(proofs) - inputFees >= amount + mf before a payment is treated as settled, with input fees from the wallet's keysets and mf priced from its melt methods. Scope is the amount only; DLEQ/lock validation stays separate.

PaymentRequest.includesMint(url) is the shared primitive: mint-list membership compared after URL normalization (unparsable foreign entries fall back to a raw comparison). The docs' previous pr.mints?.includes(myMint) example had the normalization footgun this removes.

Design notes

• Both checks live on Wallet/WalletOps because that is where the state lives (mint URL, unit, keyset fees, melt methods). An earlier draft put the settlement check on PaymentRequest and needed three wallet-state options passed in; review moved it.
• sendToRequest returns the builder rather than running it, so .includeFees(false) after the fact remains possible: deliberate opt-out, not a hole, and it keeps the builder contract uniform.
• The low-level pieces (feesFor, amountToSend, isMintListStrict) are unchanged and remain the manual-control path; docs now lead with the one-step call and keep the manual recipe below it.

Tests

• sendToRequest: fee quadrants (listed/unlisted, with/without list), URL-normalized strict-list matching, unit mismatch, unit-bound melt rejection, amountless handling, lock honour/reject.
• isPaymentRequestSatisfied: net-of-fees formula against a 1000 ppk keyset (the spec's dust scenario), mf inside/outside the mint list, unit mismatch, amountless expectation.
• includesMint: case/trailing-slash normalization, unparsable entries, absent list.

[codecov]

Codecov Report

❌ Patch coverage is 95.55556% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 95.52%. Comparing base (49f6034) to head (236de85).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/wallet/WalletOps.ts	92.30%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #787      +/-   ##
==========================================
- Coverage   95.54%   95.52%   -0.02%     
==========================================
  Files          55       55              
  Lines        5428     5473      +45     
  Branches     1345     1359      +14     
==========================================
+ Hits         5186     5228      +42     
- Misses        107      108       +1     
- Partials      135      137       +2     

Flag	Coverage Δ
integration	38.36% <0.00%> (-0.34%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.