fix: the dashboard offered pay links for invoices nothing is watching

apps/dashboard retypes the watcher's state lists, because it is a plain
browser script that cannot import from the server package. They drifted:
`cancelled` and `written_off` were added to the watcher and not here, so the
dashboard handed a payer a live link for an invoice the poller will never look
at again. That is exactly the outcome its own payLink() comment says it exists
to prevent - money in, order never shipped, no webhook.

Rather than only correcting the copy, the watcher now publishes its lists at
GET /states and the dashboard checks itself against them on load, saying so on
the screen of the person it would cost money. A retyped constant will drift
again; this makes it visible when it does.

Also, coverage for the code that decides how much money a payer sent. A
mutation pass found all ten guards in totalReceived/totalSent deletable with
the suite green. New accounting tests drive the real watcher against a node
that paginates, repeats a cursor, never stops paginating, and serves an
unreadable page.

Two of those tests initially passed against a broken build and had to be
re-aimed: the fake node corrupted every page rather than the first, so both
variants summed to zero and the test could not tell them apart. The pagination
and cursor guards remain masked by the credibility cap and the balance-delta
fallback, which dominate their outcome - noted rather than papered over with a
test that would only appear to cover them.

180 tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>