perf(net): one scan budget for all wallet scans, gated on what changed

The balance, address scan, history and probe were throttled one by one at
10% each, which added up to 30-40% of dragonxd's cs_main with all of them
due. services::WalletScanGovernor runs one wallet scan at a time across
both RPC lanes and keeps one shared quiet clock at 15% of wall-clock (cut
when the node is behind). Waiters are served first in, first out, with a
head start for what the page shows and a starvation floor of max(30 s
visible / 900 s hidden, 15x the stream's cost). Explicit work (a dirty
set, the user's send, a first load) is never refused but is charged.

Routine scans run only when the tip, the mempool size (getmempoolinfo:
no cs_main) or a wallet-mutation epoch changed since their last good scan,
or a safety sweep is due. Pages that don't show the balance poll it at
most every max(10 min, 50x its cost) (2 min with client-side auto-shield);
coming back into view with an old value fetches it at once. The staleness
badge counts from the last poll that confirmed nothing changed, and hides
while the budget holds the balance within its guarantee.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/services/history_scan_policy.h

@@ -17,6 +17,7 @@
 #include <cstddef>
 #include <string>
 #include <unordered_map>
+#include <unordered_set>
 #include <vector>
 
 namespace dragonx {
@@ -61,6 +62,22 @@ bool fullSentSweepFailureCounts(rpc::RpcFailureKind kind);
 std::size_t oldestScannedAddressIndex(const std::vector<std::string>& addresses,
                                       const std::unordered_map<std::string, int>& heights);
 
+// The between-blocks probe scans one address per run. After what it watches changed (the mempool, a wallet
+// mutation) it isn't done until it has probed every z-address once: the change may be any of them. Tracks
+// which are left, by address (heights can't tell: a rotation at one tip leaves them all equal).
+class ProbeRotation {
+public:
+    // The next address to probe: the oldest-scanned of those left. Drops addresses no longer listed, and
+    // starts a new rotation when none are left. Empty when there are no addresses.
+    std::string next(const std::vector<std::string>& addresses, const std::unordered_map<std::string, int>& heights);
+    void probed(const std::string& address) { left_.erase(address); }
+    bool complete() const { return left_.empty(); }
+    void reset() { left_.clear(); }
+
+private:
+    std::unordered_set<std::string> left_;
+};
+
 // One pass of receive scans over every z-address. An address is done once it was scanned at or above the
 // pass's start height (its floor), so a pass ends after ceil(A / budget) cycles however the tip moves. An
 // explicit pass (the first load of a wallet, or after an invalidation) may run back to back; a routine