Peering: auto-pay peer invoices within periodic budgets, with held-invoice approval #938

Part of the relay peering work in #931.

Scope

The peer (buying) side: automatic payment of peering invoices, fenced by budgets. A peering relay pays invoices on receipt from its configured Lightning wallet — no operator in the loop per invoice — but only inside a strict trust envelope. Auto-pay requires ALL of:

• The invoice comes from a configured, trusted peer (pubkey match with the authenticated connection).
• The amount matches the terms that peer advertised in its NIP-11 document.
• The invoice has not already been paid (dedupe on payment hash).
• Paying it stays within the periodic budget (below).

Periodic budgets as the trust/risk control:

• Operator-configured budget per peer and optionally a global cap across all peers, per period (e.g. X sats per peer per month). Renewals inside the same period count against the same budget. Auto-pay never exceeds the remaining budget and never borrows from the next period.
• An invoice failing any check — over budget, amount mismatch, unknown peer, duplicate — is not auto-paid. It is held and surfaced in the admin console for manual operator approval.
• Budget exhaustion stops auto-pay and notifies the operator.
• Spend is accounted per peer per period for the admin console (invoices received, paid, held, budget remaining).

Acceptance

• An invoice from a trusted peer, matching advertised terms and within budget, is paid with no operator action and the feed activates.
• Each failure mode (over budget / amount mismatch / unknown pubkey / duplicate) results in a held invoice in the console, never an auto-payment.
• Total auto-paid spend in a period can never exceed the configured budget, per peer or globally.