wallet: cache each Sapling note's decrypted plaintext in memory

GetFilteredNotes, the walk behind every balance and note-listing RPC,
sweep, consolidation, z_sendmany and z_mergetoaddress, decrypted every
note it looked at on every call: ~0.5ms of Jubjub arithmetic per note,
under LOCK2(cs_main, cs_wallet). A note's plaintext is fixed by its
output (the txid commits to the ciphertext) and the ivk that decrypts
it, so it never needs to be decrypted twice.

SaplingNoteData gains an in-memory-only
boost::optional<SaplingNoteCache> {note, memo}; the address is the
note's (d, pk_d). It follows the witnessRootValidated precedent:
- never serialized, and left out of operator== and
  SaplingNoteDataIdentical, so filling it never makes a tx look changed
  and get rewritten (the replay rewrite storm 69bb035e7 removed);
- FindMySaplingNotes fills it from the decryption that found the note
  (both the spending-key and the viewing-key-only loop);
- UpdatedNoteData's replace branch keeps a plaintext the wallet already
  had, for the same outpoint and ivk only;
- GetFilteredNotes now runs in two passes: pass 1 applies the tx,
  spent and locked filters and collects the notes that pass; whatever
  lacks a plaintext (everything after a restart, until the startup
  warm-up in a later commit) is decrypted once via the new
  FillSaplingNoteCache; pass 2 applies the address and spending-key
  filters and emits entries in the same order as before.
Spentness, spendability, lock state and depth are still decided on every
call; only the plaintext is cached.

The A0 equivalence test passes unchanged (warm). New tests:
- ColdCacheMatchesLegacy: the same grid with the cache dropped before
  every call;
- CachedPlaintextMatchesFreshDecrypt: eager and lazy fills;
- WarmPassDoesNotDecrypt: a fill counter shows a warm walk decrypts
  nothing, and spent or locked notes only when the caller asks for
  them;
- CacheNeverSerialized: byte-identical SER_DISK/NETWORK/GETHASH output,
  empty after a load;
- UpdatedNoteDataAndTheCache: no rewrite on a cache-only difference,
  carried on replace, never across another ivk;
- SpendabilityNotCached;
- FindMySaplingNotesFillsCache.

Memory: ~616 bytes per note (the memo is 512), ~8MB for a 13k-note
wallet, next to ~100KB per note of cached witnesses.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/wallet/wallet.h

@@ -301,6 +301,14 @@ class SproutNoteData
 };
 
 
+/** A Sapling note's decrypted plaintext as the wallet uses it: the note (value, rcm, and the address it
+ *  was sent to as (d, pk_d)) and its memo. */
+struct SaplingNoteCache
+{
+    libzcash::SaplingNote note;
+    std::array<unsigned char, HUSH_MEMO_SIZE> memo;
+};
+
 class SaplingNoteData
 {
 public:
@@ -328,6 +336,15 @@ public:
     // read true and short-circuit the witness self-heal in VerifyAndSetInitialWitness.
     bool witnessRootValidated = false;
 
+    //In Memory Only
+    // The note's decrypted plaintext, so the balance and note-listing calls don't redo the Sapling
+    // decryption (several Jubjub scalar multiplications) for every note on every call. It is a pure
+    // function of (txid, output index, ivk), so nothing invalidates it. Never serialized, and left out
+    // of operator== and SaplingNoteDataIdentical on purpose: a filled and an unfilled entry persist the
+    // same state, so filling one must never make a tx look changed and get rewritten. Filled by
+    // FindMySaplingNotes when the note is found, otherwise by FillSaplingNoteCache.
+    boost::optional<SaplingNoteCache> cachedPlaintext;
+
     ADD_SERIALIZE_METHODS;
 
     template <typename Stream, typename Operation>
@@ -1469,6 +1486,18 @@ public:
     bool LoadCryptedMnemonicEntropy(const uint256& entropyFp, const std::vector<unsigned char>& vchCryptedSecret);
     
     /* Find notes filtered by payment address, min depth, ability to spend */
+    /** A wallet note whose decrypted plaintext is not cached yet, with the output it decrypts. */
+    struct SaplingNoteToDecrypt {
+        SaplingNoteData* nd;
+        const OutputDescription* output;
+    };
+    /** Decrypts each note into nd->cachedPlaintext and returns how many it filled. A note that doesn't
+     *  decrypt under its ivk is left unfilled. Caller holds cs_wallet. */
+    unsigned int FillSaplingNoteCache(const std::vector<SaplingNoteToDecrypt>& notes);
+    /** Notes FillSaplingNoteCache has decrypted since startup (FindMySaplingNotes' fills not counted).
+     *  Guarded by cs_wallet. */
+    uint64_t nSaplingNoteCacheFills = 0;
+
     void GetFilteredNotes(std::vector<SaplingNoteEntry>& saplingEntries,
                           std::string address,
                           int minDepth=1,