feat(payouts): confirm payouts on-chain with a view-only wallet (#381)

[VijitSingh97]

Summary

Adds optional on-chain payout confirmation (v1.5). Every earnings figure the dashboard shows is an estimate; nothing checked that a P2Pool payout actually landed. Now, when the operator sets monero.view_key (the private view key for their payout address), the stack runs a view-only monero-wallet-rpc against the local node (scan-only — a view key cannot spend) and the dashboard confirms payouts from the chain (the coinbase outputs P2Pool pays you are the only ground truth).

• Container: monero-wallet-rpc extracted from the already-verified CLI tarball (no new image/pin). New wallet-rpc compose service on a payout_confirm profile — gated on the view key being set + local mode, non-root (uid 1000), read-only rootfs + tmpfs, loopback-only publish 127.0.0.1:18082, depends on monerod healthy. The view key reaches it via env + a tmpfs file, never the command line.
• pithead: validates/renders monero.view_key (refused on a remote node; 64-hex checked) + monero.payout_scan_height; generates & preserves the wallet-rpc login; masks view_key in the control config; keeps the secrets off the Stack config editor: change any setting from the dashboard, applied via pithead (incl. P2Pool mode hot-swap) #33 dashboard-editable allowlist (named deliberately in the comment).
• Dashboard: MoneroWalletClient polls get_transfers on the slow (~5 min) cadence; new payouts table keyed (chain, txid) so the Tari sibling Confirm Tari payouts on-chain with a view-only minotari wallet (sibling of #381) #462 reuses this exact table with chain="tari" (this feature sets chain="monero"); confirmed 24h/7d/all-time totals beside the estimate; one payout_confirmed alert per new payout (idempotent storage + height seeding ⇒ no replay on restart; coinbase recorded on confirmation, not maturity).
• Docs: configuration.md entries; a "Payout confirmation" section in dashboard.md stating the full view-key security model; CHANGELOG under [Unreleased].

Security model

• A view key cannot spend — it can only scan — but it reveals every incoming payout amount and timing to anyone who reads config.json/.env. Handled exactly like node_password: owner-only .env, never logged/echoed, off the dashboard config editor, never on a container command line (red-then-green no-leak test).
• The wallet-rpc stays on the box: loopback-only publish, non-root, read-only rootfs, password-authenticated; Phase 1 is local node only (a view key with monero.mode: remote is refused).
• Empty view key (the default) = feature off, nothing new runs.

payouts table schema

payouts (chain TEXT, txid TEXT, height INTEGER, ts REAL, amount_atomic INTEGER, PRIMARY KEY (chain, txid)) — shared with #462.

Tests

make lint + make test green. Dashboard coverage 96.7% (≥80); patch coverage 97–98% (≥90). New: wallet client parsing + payouts round-trip/idempotency + alert edge (tier 1), fake wallet-rpc contract test (tier 2), config→.env render + view-key-never-leaked (tier-1 shell).

Closes #381

🤖 Generated with Claude Code