fix: close what the re-audit found still open

A second adversarial pass verified five of the eight earlier fixes and broke
three. Those three, plus the defects it surfaced:

- evaluateInvoice defaulted a missing baseline to zero, which is absolute-
  balance confirmation by another name. The pre-fix watcher wrote exactly
  such rows, so upgrading resurrected the false-paid bug on every open
  invoice. A baseline is now required, and restore() parks legacy rows as
  needs_reregistration instead of watching them.
- The sent-payment record lived only in memory, so a payer who reloaded
  after a confirmation timeout paid twice, and the reloaded page re-baselined
  after the first payment so the second one confirmed. It is persisted now,
  and matched on the invoice's terms rather than its id alone: reusing an id
  with a different amount can no longer claim someone else's payment.
- resolveToken read Object.prototype, so toString and __proto__ resolved
  to a TokenInfo of undefineds instead of being refused. Own properties only,
  in both the widget and the watcher.
- The watcher accepted a declared decimals that contradicted a known token,
  confirming an invoice for 1 STRK on a millionth of one while the webhook
  still said 1 STRK. Contradictions are refused and tokenAddress is validated.
- verifySignature returned true for an empty secret, so a merchant missing
  the env var accepted forged deliveries. It fails closed.
- createInvoice checked id and address uniqueness before an awaited read, so
  concurrent registrations could overwrite each other or share an address.
  The id is reserved before the await and released if it fails.
- e2e-live.mjs wrote into the real invoice store and had left a forged paid
  row sitting untracked in this repo. It uses a temp store, and invoice
  ledgers are gitignored.
- Two tests asserted the opposite of their names; both said what they check
  now. npm test builds first, so src can never be verified against stale dist.

56 tests. Live mainnet proof still passes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>