fix(mining): remediate mining-tab audit (22 findings) — crash-safety, async control, validation, math

Fixes all 22 confirmed findings from the mining-tab audit (10 Medium, 12 Low; 0 Critical/High),
adversarially reviewed (6 follow-ups found + fixed, incl. the review-caught idle-auto-start bypass
and a wrong benchmark-restore condition).

Crash-safety & lifecycle:
- M-04: join a stale/finished monitor thread in XmrigManager::start() and ~XmrigManager so an xmrig
  crash-then-restart (or quit) no longer std::terminate()s the wallet.
- L-03/L-10: surface an unexpected miner exit once and clear the stale running flag.

UI never blocks (M-03/L-06/L-08/L-09/L-13): pool start/stop now run on a dedicated serialized FIFO
mining-control thread (joined before teardown), so the ~13 call sites don't block the render thread on
stop()'s SIGTERM->SIGKILL->join; the spawn result marshals back to the UI.

Miner-process / pool trust boundary:
- M-01: validate the payout address (util::isValidRecipientAddress) at EVERY start path — the UI gate
  AND App::startPoolMining() (idle auto-start / thread scaling) — so a stale/wrong-chain address can't
  silently lose rewards.
- M-09: SSRF guard skips the background pool-stats GET for loopback/private/link-local/single-label hosts.
- M-02/L-02: cap the pool-stats + xmrig-API HTTP response bodies.
- L-01: write the xmrig config 0600 at creation (POSIX open with mode) — no world/group-readable window.
- M-10: reject shell-metacharacter binary paths before the version popen (excluding '()' so Program Files
  (x86) still works).

Solo mining: M-06/M-08 clamp thread count to [1, cores] at the setgenerate/xmrig boundary; M-07 notify +
don't lie on stop failure.

Correctness: L-05 block-time constant 75->150s (chainparams); M-05 discloses pool-mode "Est. Daily" as a
rough solo-equivalent; L-04/L-11/L-12 benchmark lifecycle (cancel on nav-away / mode-switch with restore,
skip rebalance mid-benchmark); L-07 honor cancel mid-extract in both the xmrig and daemon updaters.

Two new i18n keys back-filled across all 8 languages; CJK subset font rebuilt for the new glyphs.
Verified across full-node, lite, and Windows builds; tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/util/daemon_updater.cpp

@@ -354,6 +354,7 @@ void DaemonUpdater::installResolved(const std::string& targetDir, const DaemonRe
     bool failed = false;
     const int numFiles = static_cast<int>(mz_zip_reader_get_num_files(&zip));
     for (int i = 0; i < numFiles && !failed; ++i) {
+        if (cancel_requested_) { failed = true; break; }   // honor cancel mid-extraction so the join returns promptly (L-07)
         mz_zip_archive_file_stat st;
         if (!mz_zip_reader_file_stat(&zip, i, &st)) continue;
         if (mz_zip_reader_is_file_a_directory(&zip, i)) continue;

src/util/i18n.cpp

@@ -1880,6 +1880,8 @@ void I18n::loadBuiltinEnglish()
         strings_["mining_open_in_explorer"] = "Open in explorer";
         strings_["mining_payout_address"] = "Payout Address";
         strings_["mining_payout_tooltip"] = "Address to receive mining rewards";
+        strings_["mining_payout_invalid"] = "Not a valid DragonX address — fix it before starting, or mining rewards are lost.";
+        strings_["mining_est_daily_pool_sub"] = "rough solo-equivalent, before pool fee";
         strings_["mining_generate_z_address_hint"] = "Generate a Z address in the Receive tab to use as your payout address";
         strings_["mining_pool"] = "Pool";
         strings_["mining_payout_foreign"] = "⚠ This payout address isn't in your current wallet — mined rewards would go to a different wallet. Update it if you switched wallets.";

src/util/pool_stats_service.cpp

@@ -13,8 +13,14 @@ namespace {
 
 size_t writeStringCb(void* contents, size_t size, size_t nmemb, void* userp)
 {
-    static_cast<std::string*>(userp)->append(static_cast<char*>(contents), size * nmemb);
-    return size * nmemb;
+    auto* s = static_cast<std::string*>(userp);
+    const size_t add = size * nmemb;
+    // Pool stats JSON is tiny; refuse an unbounded body from a hostile/MITM'd endpoint (returning < add
+    // aborts the transfer) so it can't grow this string until OOM. (M-02)
+    constexpr size_t kMaxPoolStatsBytes = 1u << 20;  // 1 MiB
+    if (s->size() + add > kMaxPoolStatsBytes) return 0;
+    s->append(static_cast<char*>(contents), add);
+    return add;
 }
 
 // Returning non-zero asks libcurl to abort the transfer — used so shutdown doesn't

src/util/xmrig_updater.cpp

@@ -345,6 +345,7 @@ void XmrigUpdater::installResolved(const std::string& targetDir, const XmrigRele
     bool failed = false;
     const int numFiles = static_cast<int>(mz_zip_reader_get_num_files(&zip));
     for (int i = 0; i < numFiles && !failed; ++i) {
+        if (cancel_requested_) { failed = true; break; }   // honor cancel mid-extraction so the dialog's join returns promptly (L-07)
         mz_zip_archive_file_stat st;
         if (!mz_zip_reader_file_stat(&zip, i, &st)) continue;
         if (mz_zip_reader_is_file_a_directory(&zip, i)) continue;