perf(chat): sends re-read by origin, chat scans under the scan budget

A z_sendmany submit set off a burst of wallet scans before anything had
changed. Ops now re-read the wallet when they finish, by who started them:
the user's sends and dialog ops get a re-read plus one forced balance once
none of their ops is pending; client auto-shield re-reads unforced; chat
messages and splits refresh only the chat note view. A pending send no
longer forces scans, and chat txids no longer enter the tracked-send set.

Chat ingest skips stored messages before decrypting and caches
undecryptable ones per identity. The inbox scan runs when getwalletinfo's
txcount changed (a cheap probe, at most 2% duty) or a cost-scaled safety
net is due; the note-buffer scan runs on need. Both are admitted by the
scan budget, on a steady clock. The chat payer comes from a per-address
view of verified notes, with debits re-applied across in-flight scans;
splits are sized to one payer and only when they can refill the buffer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/services/wallet_scan_governor.h

@@ -82,7 +82,7 @@ struct BalancePollInputs {
     bool background = false;       // the window is in the background: no first read while syncing
     bool firstReadTried = false;   // the first read while syncing was already sent this connection
     bool gateOpen = true;          // the connect gate (C44): closed right after a connect, at most ~20 s
-    bool forced = false;           // the user's own send
+    bool forced = false;           // the user's own send (waits while the window is in the background)
     bool neverFetched = false;     // no balance yet this session
     bool changed = true;           // the governor's change gate
     bool visible = true;           // the page shows the aggregate balance
@@ -123,8 +123,10 @@ public:
             {kScanSignalAll, 300},   // Addresses
             {kScanSignalTip | kScanSignalEpoch, 0},   // History
             {kScanSignalMempool | kScanSignalEpoch, 0},   // RecentTx (between blocks: the tip is History's)
-            {kScanSignalAll, 60},    // ChatNotes
-            {kScanSignalAll, 60},    // ChatFast
+            {0, 0},   // ChatNotes: admission only; the need is services::shouldScanChatNotes (tip settle, chat ops)
+            {0, 0},   // ChatFast: admission only; the need is getwalletinfo's txcount (chatInboxScanNeeded). Not
+                      // the tip or mempool: they move before the wallet notifier stores the tx, so a scan fired
+                      // on them can read the old wallet and consume the change.
             {0, 0},                  // Adhoc
         }};
     };