fix(watcher): keep the invoice state machine monotonic

Sweeping the partial payment out of an underpaid address made the row read
as expired on the next poll, because settlement compares a live balance to a
baseline and a swept address looks like one nobody paid. Expired is deletable,
and deleting releases the address for reuse, so the state that exists to hold
an address open was undone by the merchant touching it.

Track the high-water mark instead of the current delta, and warn when a
watched address loses value: delta accounting cannot see money already moved
out, so sweeping early under-credits the payer either way.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>