fix(robustness): guard malformed RPC error JSON + send single-flight (audit #7-8)

- rpc_client::callRaw: a daemon error object is no longer assumed to carry a string
  "message" — a malformed error now yields a clean "RPC error: <dump>" instead of throwing
  a json type-exception from .get<std::string>().
- sendTransaction (full-node): add a single-flight guard so a rapid double-click can't issue
  two z_sendmany before the first returns its opid. The lite path already guarded this; the
  send form guards it in the UI, but the controller entry point now does too.

(#9 from the audit was mostly false positives on verification — all popen sites already
null-check and the xmrig download FILE* path has no throwing calls. The payment-URI
checksum idea was dropped: the send flow already checksum-validates the recipient before
broadcasting, and tightening the parser would reject the placeholder addresses the existing
test relies on; added a comment noting this is format-only by design.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app_network.cpp

@@ -2240,7 +2240,16 @@ void App::sendTransaction(const std::string& from, const std::string& to,
         if (callback) callback(false, "Not connected");
         return;
     }
-    
+
+    // Single-flight guard: a rapid double-click (or any second caller) must not issue two
+    // z_sendmany calls before the first returns its opid. The send form already guards this in the
+    // UI, but the controller entry point must not depend on that. (send_submissions_in_flight_ is
+    // main-thread only: ++ here, -- in the worker's main-thread result callback.)
+    if (send_submissions_in_flight_ > 0) {
+        if (callback) callback(false, "A transaction is already being submitted — please wait.");
+        return;
+    }
+
     // Check that we have the spending key for the from address
     if (!from.empty() && from[0] == 'z') {
         bool spendable = false;