[ihordiachenko]

Fixes: #925.

Routing-balance checks were disabled for amountless invoices, leaving routing fees unenforced. A flat 1,000-sat cap also rejects large trampoline payments because their 0.5% surcharge exceeds it. This change restores enforcement with configurable fee budgets instead of raising max_feerate_per_kw.

A validator wrapper supplies an amount-dependent allowance while VLS accounts for each payment across channels and HTLC parts. This avoids a VLS fork, at the cost of delegation code that must be checked on upgrades. We intend to move this logic into VLS.

Defaults, configurable through SignerConfig::fee_budget_limits and signer CLI flags:

• Routing: the larger of 1,000 sat and 0.5% of the payment amount, shared across all parts and channels.
• Commitments and local HTLC transactions: 100,000 sat per new commitment or signed local HTLC input.
• Mutual closes: 50,000 sat per transaction.

On-chain caps apply independently of policy filters and permissive mode; fee-rate policies remain warnings. Stored commitments remain signable for force-close, with an over-budget warning. Sweeps and withdrawals retain the 150,000 sat/kW ceiling.

Minor related fixes that were blocking testing/implementation:

• Register invoice-backed sendpay payments synchronously;
• Recognize direct-invoice xpay
• Allow amountless-invoice retries with a changed amount after earlier HTLCs clear.
• Signer errors during invoice and keysend preapproval return payment errors instead of blocking the node;
• Early checks reject excessive requested fee limits for pay, direct-invoice xpay, and trampoline;
• SDK send and LNURL pay set matching default limits.