wallet/init: decrypt every wallet note into the plaintext cache at startup

The plaintext cache is in memory only, so a restart empties it. Without
a warm-up, the first balance call after a restart decrypts the whole
wallet under LOCK2(cs_main, cs_wallet): ~6s for a 12k-note wallet. That
is the observed failure: restart, the GUI connects, and the node looks
stuck.

CWallet::WarmSaplingNoteCache decrypts every note whose plaintext isn't
cached, spent ones included, because z_listreceivedbyaddress
(ignoreSpent=false) is called once per address by the GUI's history
scan.

init runs it at the end of the wallet block, just before
SetBroadcastTransactions. At that point RPC is still in warmup (it
shows "Decrypting wallet notes...") and the wallet notification
thread, whose startup witness rebuild can hold cs_wallet for a long
time, has not started yet. It takes cs_wallet only. -notecachewarmup=0
(debug help) skips it, which leaves the lazy fill in GetFilteredNotes
to do the work.

Unlike GetFilteredNotes, the warm-up never asserts. A note that doesn't
decrypt under its ivk, or names an output its tx lacks, is counted in
the summary line and listed under -debug=zrpcunsafe. A corrupt note
therefore can't stop the node from starting, or from serving the
key-export RPCs allowed during warmup; GetFilteredNotes still asserts
on it, as before.

Tests:
- WarmUpFillsEveryNote: spent, locked, unconfirmed and stale-block
  notes included; walks afterwards decrypt nothing.
- WarmUpSkipsBadNotes: undecryptable and out-of-range notes are skipped
  without aborting.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/wallet/wallet.cpp

@@ -5743,6 +5743,43 @@ unsigned int CWallet::FillSaplingNoteCache(const std::vector<SaplingNoteToDecryp
     return nFilled;
 }
 
+// wallet.dat doesn't store the plaintext, so without this the first balance call after a restart decrypts
+// the whole wallet under cs_main (~0.5ms a note). init runs it before RPC leaves warmup and before the
+// wallet notification thread starts, so nothing waits on cs_wallet meanwhile. Unlike GetFilteredNotes it
+// never asserts, so a corrupt note can't stop the node from starting (or from serving the key-export RPCs
+// allowed during warmup); GetFilteredNotes still asserts on such a note, as before.
+void CWallet::WarmSaplingNoteCache()
+{
+    const std::chrono::steady_clock::time_point start = std::chrono::steady_clock::now();
+    LOCK(cs_wallet);
+    std::vector<SaplingNoteToDecrypt> uncached;
+    unsigned int nNotes = 0, nBad = 0;
+    for (auto& p : mapWallet) {
+        CWalletTx& wtx = p.second;
+        for (auto& item : wtx.mapSaplingNoteData) {
+            nNotes++;
+            if (item.second.cachedPlaintext)
+                continue;
+            if (item.first.n >= wtx.vShieldedOutput.size()) {
+                LogPrint("zrpcunsafe", "%s: note %s:%u has no such output\n", __func__, item.first.hash.ToString(), item.first.n);
+                nBad++;
+                continue;
+            }
+            uncached.push_back(SaplingNoteToDecrypt { &item.second, &wtx.vShieldedOutput[item.first.n] });
+        }
+    }
+    const unsigned int nFilled = uncached.empty() ? 0 : FillSaplingNoteCache(uncached);
+    for (const SaplingNoteToDecrypt& n : uncached) {
+        if (!n.nd->cachedPlaintext) {
+            LogPrint("zrpcunsafe", "%s: a note of output %s does not decrypt under its ivk\n", __func__, n.output->cm.ToString());
+            nBad++;
+        }
+    }
+    const int64_t nMs = std::chrono::duration_cast<std::chrono::milliseconds>(std::chrono::steady_clock::now() - start).count();
+    LogPrintf("%s: decrypted %u of %u Sapling notes in %dms%s\n", __func__, nFilled, nNotes, nMs,
+              nBad ? strprintf("; %u could not be decrypted (-debug=zrpcunsafe lists them)", nBad) : "");
+}
+
 // Replaces tx_height() on the wallet's note paths. tx_height() re-read the tx from disk through
 // GetTransaction, once per wallet tx (or per returned note) under LOCK2, and on a -txindex=0 node it
 // never found a fully shielded tx, so those notes were silently skipped. The depth already locates