perf(history): persist the sent-sweep watermark (windowed relaunch)

z_listsentbyaddress re-walks the whole wallet when there's no usable
watermark, which the daemon does under cs_main for every send -- hundreds
of seconds, 400+ s and ~19 GB RSS on a large wallet. The watermark lived
only in memory, so every relaunch, reconnect or daemon restart paid for a
full sweep. This persists it so those cases run a bounded windowed sweep
([z, 0, 2, tip - W + margin]) instead (SENT-HISTORY-SWEEP Part 1).

- The watermark (W = last swept tip), its anchor (A = W - margin) and anchor
  hash (H_A = getblockhash(A)), plus the enrichment backlog and the full-
  sweep backoff, ride in the encrypted history snapshot as an optional
  `sent_sweep` object (schema stays v1; a missing/inconsistent one reads as
  "no watermark" = today's behaviour, so older builds and payloads are safe).
- Before the first windowed sweep after a load, the anchor is verified
  (getblockhash(A) == H_A). A match means any fork is inside the window; a
  mismatch (reorg deeper than the margin, different chain/datadir) or an
  inability to check drops the watermark and sweeps the whole wallet.
- The first sweep after a load uses a bigger margin (absorbs notifier lag),
  and a watermark older than 2400 blocks uses the long timeout (callLong).
- The backlog is persisted WITH W: a pure z->z send's txid lives only in a
  sweep result and would be lost if the window moved past an un-enriched one.
- Watermark changes reach disk (folded into the store signature), and every
  hard case still forces a full sweep: reorg (anchor verify), GUI rescan /
  zap / import / address change, restoreOriginalWallet, and disconnect.

Deferred (follow-ups, each only turns a correct-but-slow case faster, never a
correctness risk): the banded full sweep for seeding on a pre-note-cache
daemon, the external-import tripwire, and the weekly safety-net re-sweep.
Part 2 (the daemon's decrypt cost) is already on the daemon's
perf/sapling-note-cache branch.

Pure helpers + cache round-trip + anchor-verify/large-window covered by
tests; the getblockhash-after-sweep updates the pinned RPC sequences.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/services/network_refresh_service.h

@@ -254,7 +254,13 @@ public:
         std::unordered_map<std::string, int> priorityScanFloors;
         bool skipShieldedScans = false;   // a Light cycle (or a probe-less recent poll): no receive scans
         bool skipSentSweep = false;
-        int sentScanFromHeight = -1;      // the sweep's watermark; -1 = sweep the whole wallet
+        int sentScanFromHeight = -1;      // the sweep's watermark (W); -1 = sweep the whole wallet
+        // A loaded watermark owes an anchor verify before its first windowed sweep: getblockhash(A) must
+        // still equal H_A (no reorg deeper than the margin). A mismatch forces a full sweep. While pending,
+        // the window also uses the bigger first-after-load margin.
+        bool sentVerifyPending = false;
+        int sentVerifyAnchorHeight = -1;  // A
+        std::string sentVerifyAnchorHash; // H_A
         std::size_t transparentRowHint = 0;   // listtransactions rows last time: sizes the first page
         // Same tip and nothing changed since the rows on screen were fetched: reuse their transparent rows
         // instead of paging listtransactions again.
@@ -291,7 +297,9 @@ public:
         bool sentSweepRan = false;
         bool sentSweepOk = false;
         bool sentSweepFull = false;
-        int sentSweepHeight = -1;                 // the tip a successful sweep covered
+        int sentSweepHeight = -1;                 // W: the tip a successful sweep covered
+        int sentSweepAnchorHeight = -1;           // A = W - margin, the bottom edge the window covered
+        std::string sentSweepAnchorHash;          // H_A = getblockhash(A), fetched after a successful sweep
         double sentSweepMs = 0.0;                 // time in the sweep (part of scanMs)
         rpc::RpcFailureKind sentSweepErrKind = rpc::RpcFailureKind::None;
         // Txids found but not enriched (over the per-cycle cap, or the view failed transiently): the caller