[USCMig]

Stacked on #35 (batch payments), and through it on #34, #33 and #32. Merge those first; until then this diff also shows their changes.

Summary

Pay if agreed. A group poll can propose payments, so the group agrees on exactly what to pay before anyone is asked to sign. This connects discussion, vote and payment.

1. Propose. In New poll, tick Propose a payment and enter the payments. It uses the same rows as batch payments: an address or saved payee, an amount and a memo, up to 20. The options become Pay and Don't pay.
2. Vote. Members answer as on any poll. Pay is agreed once as many members choose it as a payment needs.
3. Send. The member who proposed it gets Send payment, with members to ask preselected (those who chose Pay). The backend builds the transaction from the poll itself and uses the poll's question as the reason.
4. Approve. Each approver's app checks the request against its own copy of the poll.
5. Paid. After broadcast, the poll shows Paid and can't be sent again.

Safeguards

• The sender checks the poll first. wallet_send with a poll_id refuses unless this member proposed the poll, the group agreed to pay, and the poll hasn't been paid. The payments come from the poll, never from the caller.
• Approvers check it against their own copy. check_poll refuses automatically when:
  • the request is sent by anyone but the poll's author;
  • the transaction doesn't make exactly the proposed payments (an unordered match on address, amount and memo, using the same address forms as payees);
  • the poll was already paid.
• Approvers see where the poll stands. The app shows "Agreed in the poll …: 2 chose Pay, 2 needed", or warns that it isn't agreed, was declined, or isn't on this device yet.
• Who asked is authenticated. The coordinator's key now comes with the approval event; the request's Noise encryption authenticates it.
• A poll pays once. Only the poll's author's PollPaid record counts. The sender's app refuses a second send, and approvers' apps refuse to sign one.

Not in this PR

Having the apps of members who chose Pay approve automatically is left for the spending-limit rules in TODO.md. For now they approve as usual, with the poll check shown.

Changes

• Core
  • polls.rs: new ProposedPayment, Poll.payments, PollPaid and their limits in check(); PollView.payments and paid_txid.
  • events.rs: SigningContext.poll_id, and AwaitingApproval.coordinator.
  • signing.rs: passes the coordinator through.
  • wallet.rs: is_transparent_address.
• App
  • commands/polls.rs: create_poll takes payments and checks them as a send would; new pays_what_was_proposed.
  • commands/wallet.rs: wallet_send takes poll_id, then records PollPaid and the reason after broadcast.
  • commands/signing.rs: check_poll in the gate, and a poll annotation on the approval event.
• Frontend
  • Votes: the proposal form; the proposed payments on the poll card; and the outcome, which is either Send payment with signer picker, "Alice can send it now", "decided not to pay", or "Paid".
  • Approvals: the poll status.
• Docs: a "Propose a payment" section in docs/VOTING.md, plus the user guide, README, CHANGELOG and TODO.md.

Testing

• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• tsc, then vitest (34 tests)
• Core tests:
  • a_poll_proposes_payments_and_only_its_author_marks_it_paid
  • a_poll_proposing_payments_is_refused_unless_well_formed
• App test: a_transaction_pays_what_was_proposed_only_if_it_makes_exactly_those_payments. It covers any order, a missing payment, a changed amount, a different memo, another recipient, an extra payment, and each proposed payment matching only once.
• Devnet (NU7), tests/devnet_send.rs, which passed. After the batch:
  1. Alice proposes a payment, and Bob's app gets the poll with options Pay / Don't pay.
  2. Sending before the group agrees is refused.
  3. Both vote Pay.
  4. Bob can't send it.
  5. Alice sends it; Bob's app reports the poll as found and agreed, and the transaction is mined.
  6. Bob's app shows it paid, and a second send is refused.
• Frontend tests:
  • Proposing a payment, with fixed options and payee picking.
  • The author sending it, with signers defaulting to the Pay voters and poll_id and reason passed through.
  • Other members seeing who can send it, then "Paid".
  • The approver seeing the poll agreement.
• Screenshots of the proposal form, poll card and approval were checked against a production build.

🤖 Generated with Claude Code