fix: size the deposit to the shortfall, and clear the remaining audit findings

Inline shielding ignored what the payer already held, so a payer with 5 of the
11 they needed was asked for 17 instead of 12 and the extra 5 was stranded in
the pool behind another fee to get out. depositNeededFor now takes the balance
and returns the top-up plus one fee for the deposit that delivers it.

- A `watching` row is always polled. Gating that on a grace window meant a
  watcher down across the window came back to rows that would never be looked
  at again: not polled, not deletable, not cancellable once anything arrived.
- A row whose createdBlock call failed at create time is backfilled on the
  first poll that can reach the chain, instead of being stuck on the weaker
  balance-delta accounting forever with no route to repair it.
- The watcher refuses non-loopback Host headers, like its dev-server sibling:
  it binds loopback, so any other hostname reaching it is DNS rebinding.
- The store's doc comment said sessionStorage, which stopped being true, and
  said nothing about what localStorage persists on a shared origin. Both fixed,
  and the probe key is blanked rather than left behind.
- The dashboard's shared-origin guard missed a trailing-dot hostname, which is
  a legal spelling of the same host and a different origin to a browser.

117 tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>