perf(history): scan shielded history in bounded passes, not every block

Every block re-ran z_listreceivedbyaddress for every z-address (O(wallet)
each, under cs_main) and a whole-wallet z_listsentbyaddress. On a 40-address
wallet that was ~80% of wall-clock. The history now advances in passes:

- an address is rescanned when it is stale by a number of blocks scaled to
  its measured cost (8 to 500), never-scanned and hinted addresses first
  (a hint: z_listunspent shows a note the history doesn't);
- z_listsentbyaddress covers only the blocks since the last good sweep
  (+100 reorg margin); the whole-wallet sweep runs once per connect, with
  a 10 min / 1 h / 6 h backoff after real failures;
- listtransactions pages are sized from last time, and an unchanged tip
  reuses the transparent rows;
- found-but-unenriched txids carry over as a backlog; only -5 is a
  definitive "not ours" for z_viewtransaction;
- between blocks, a cheap recent poll plus a one-address probe.

Duty model for a 40-address wallet at 10 s per scan: ~9% instead of ~80%.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CMakeLists.txt

@@ -466,6 +466,7 @@ set(APP_SOURCES
     src/app_security.cpp
     src/app_sweep.cpp
     src/app_wizard.cpp
+    src/services/history_scan_policy.cpp
     src/services/network_refresh_service.cpp
     src/services/note_consolidation.cpp
     src/services/refresh_scheduler.cpp
@@ -613,6 +614,7 @@ endif()
 
 set(APP_HEADERS
     src/app.h
+    src/services/history_scan_policy.h
     src/services/network_refresh_service.h
     src/services/refresh_scheduler.h
     src/services/wallet_security_controller.h
@@ -1148,6 +1150,7 @@ endif()
 if(BUILD_TESTING)
     add_executable(ObsidianDragonTests
         tests/test_phase4.cpp
+        src/services/history_scan_policy.cpp
         src/services/network_refresh_service.cpp
         src/services/note_consolidation.cpp
         src/services/refresh_scheduler.cpp