refactor(audit): batch 6 — de-duplicate the app_network send/balance paths

Three behavior-preserving consolidations in src/app_network.cpp:

1. Fold the three near-identical pending-send balance-delta blocks
   (upsertPendingSendTransaction debit, removePendingSendTransactions
   restore, applyPendingSendBalanceDeltas debit) into one
   App::applyPendingSendDelta(from, signedAmount, includeAggregates). The
   restore path's unclamped `+amt` is provably identical to the clamped
   signed form (balance/amount are >=0 invariants), so a single clamped
   helper reproduces all three exactly.

2. Collapse createNewZAddress/createNewTAddress into one
   App::createNewAddress(bool shielded, cb) with thin public forwarders,
   preserving the lite early-return, the dual push into the type list AND
   the combined state_.addresses view, and the dirty-flag/refresh bookkeeping.

3. Extract App::submitZSendMany() shared by sendTransaction and
   resendWithFeeGapWorkaround — the only differences (the TraceScope label
   and the retry-only send_feegap_retried_opids_.insert) become parameters.
   The in-flight counter, opid tracking, upsertPendingSendTransaction, and
   pending_send_callbacks_ bookkeeping are byte-equivalent.

Full-node + Lite build clean; ctest 1/1; hygiene clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/app.h

@@ -12,6 +12,7 @@
 #include <chrono>
 #include <unordered_map>
 #include <unordered_set>
+#include <nlohmann/json_fwd.hpp>
 #include "data/transaction_history_cache.h"
 #include "data/wallet_state.h"
 #include "rpc/connection.h"
@@ -448,6 +449,11 @@ private:
 
     bool sendStopCommandSafely(rpc::RPCClient& client, const char* context);
     void maybeFinishTransactionSendProgress();
+    // Shared body of createNewZAddress/createNewTAddress (which are thin public forwarders).
+    // `shielded` selects the z_getnewaddress/getnewaddress RPC, the "shielded"/"transparent" type
+    // string, and the z_addresses/t_addresses target (the new AddressInfo is pushed into both that
+    // list and state_.addresses). Lite builds derive locally via the controller and early-return.
+    void createNewAddress(bool shielded, std::function<void(const std::string&)> callback);
     void upsertPendingSendTransaction(const std::string& opid,
                                       const std::string& from,
                                       const std::string& to,
@@ -464,10 +470,28 @@ private:
     void resendWithFeeGapWorkaround(const std::string& from, const std::string& to,
                                     double amount, double fee, const std::string& memo,
                                     std::function<void(bool, const std::string&)> callback);
+    // Shared z_sendmany submit path for sendTransaction (single recipient, markFeeGapRetry=false)
+    // and resendWithFeeGapWorkaround (recipient + self-output, markFeeGapRetry=true). Owns the
+    // in-flight increment, the worker post + call, and the result closure (dirty flags, opid
+    // tracking, pending-send bookkeeping, callback delivery). Callers build `recipients` (and pass
+    // the recipient `to`/`amount`/`memo`/`fee` used to record the optimistic pending-send row).
+    // When markFeeGapRetry is set, the returned opid is recorded in send_feegap_retried_opids_ so a
+    // retry of a retry is reported as a real error.
+    void submitZSendMany(const std::string& from, const std::string& to, double amount, double fee,
+                         const std::string& memo, const nlohmann::json& recipients,
+                         const char* traceLabel, bool markFeeGapRetry,
+                         std::function<void(bool, const std::string&)> callback);
     void markPendingSendTransactionSucceeded(const std::string& opid,
                                              const std::string& txid);
     void removePendingSendTransactions(const std::vector<std::string>& opids,
                                        bool restoreBalances);
+    // Apply a signed per-address balance delta for a pending send: walk z_addresses then
+    // t_addresses for `fromAddress` and clamp its balance at >=0. A positive `signedAmount`
+    // restores a debit; a negative one applies it. When `includeAggregates` is set, adjust the
+    // private/transparent bucket (chosen by the address's leading 'z') and totalBalance with the
+    // same clamp. Shared by the three pending-send delta sites so they can't drift.
+    void applyPendingSendDelta(const std::string& fromAddress, double signedAmount,
+                               bool includeAggregates);
     // Deliver a deferred z_sendmany result to its waiting UI callback once the opid
     // reaches a terminal status. Returns true if a callback was registered (and fired).
     bool invokeSendResultCallback(const std::string& opid, bool ok,