perf(chat): sends re-read by origin, chat scans under the scan budget

A z_sendmany submit set off a burst of wallet scans before anything had
changed. Ops now re-read the wallet when they finish, by who started them:
the user's sends and dialog ops get a re-read plus one forced balance once
none of their ops is pending; client auto-shield re-reads unforced; chat
messages and splits refresh only the chat note view. A pending send no
longer forces scans, and chat txids no longer enter the tracked-send set.

Chat ingest skips stored messages before decrypting and caches
undecryptable ones per identity. The inbox scan runs when getwalletinfo's
txcount changed (a cheap probe, at most 2% duty) or a cost-scaled safety
net is due; the note-buffer scan runs on need. Both are admitted by the
scan budget, on a steady clock. The chat payer comes from a per-address
view of verified notes, with debits re-applied across in-flight scans;
splits are sized to one payer and only when they can refill the buffer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/services/wallet_scan_governor.cpp

@@ -52,7 +52,9 @@ BalancePollDecision decideBalancePoll(const BalancePollInputs& in)
     // attempt failed) the balance waits for the sync to finish, a forced one too.
     if (in.neverFetched && !(in.syncing && (in.background || in.firstReadTried))) return BalancePollDecision::Explicit;
     if (in.syncing) return BalancePollDecision::Skip;
-    if (in.forced) return BalancePollDecision::Explicit;
+    // The user's own send, now committed. In the background it waits for the window (the routine rules below
+    // still apply, e.g. the auto-shield poll); coming back forces it.
+    if (in.forced && !in.background) return BalancePollDecision::Explicit;
     if (!in.changed) return BalancePollDecision::Skip;
     if (in.visible) {
         // Just came into view with an old value: fetch it now rather than queue behind the other streams.