feat: add private payment requests - #1172

Flagging while QA’ing with the staging public-pay pubkys — not a prod issue (Paykit UI is still hidden).

Enabling payments with contacts fail-closes with Unknown error if a saved contact’s receiver marker doesn’t parse (here: missing noise_public_key). I hit it on:

• pubky1jy146y751hkgqk9p69ds5cqf461aj5x7c8ptbca5rw6m9asotso
• pubkynekaxdyt5ktoqyufd7cgug6qppa7999hm46wfqdzm6jqnr8tj16o

In principle the same thing could happen with any broken / outdated profile marker, not only these fixtures. Recording attached. Same surface on iOS after #676 (toast there is Private Paykit is not available).

Steps:

1. Enable Paykit UI. Create a profile. Leave payments with contacts off.
2. Add either (or both) staging pubkys above as contacts. They do not need to be live.
3. Enable payments with contacts.
4. Toast is Unknown error and the toggle stays off.

logs.zip

Flagging from QA: paying a payment request that’s larger than the wallet balance.

Same setup, two directions, both recordings attached:

• iOS → Android (this PR): incoming sheet, Pay → toast Insufficient Spending Balance (e.g. ₿ 78,244 more needed to pay this Lightning invoice) and a red-bordered card. Dismiss then fails with Payment request operation is already in progress. Toast / error repeats; request stays on the sheet and is hard to dismiss.

• Android → iOS (ldk-node Error #676, already merged): Pay → Please try again. Coin selection failed. Dismiss is fine; the copy is just the wrong error.

Steps:

1. Two live wallets with payments-with-contacts on. Put ~88k on the payer (split savings + spending is fine).
2. Other wallet requests more than that total (100k Android-as-payer, 90k iOS-as-payer).
3. On the incoming request, tap Pay, then try Dismiss.

Expected: don’t enter confirm if the amount is above spendable. On Android, Dismiss should still work after a failed Pay (no already in progress loop).

Addressed both QA findings in signed commit 5d39cd96a:

• A malformed remote receiver marker is still rejected and cannot be used, but its per-contact inspection error no longer aborts global private endpoint publication for valid contacts. The regression test now covers the immediate-publication path used when enabling Contact Payments.
• An unaffordable request now releases its manual presentation state after showing the existing insufficient-balance message. It remains pending and dismissible, is not accepted or rejected, and does not consume a Private Payment List. The regression test verifies Dismiss remains actionable and no retry starts from the old context.

The matching iOS fixes are isolated in synonymdev/bitkit-ios#684: malformed remote markers no longer block other contacts, and incoming request amounts are used during initial LN/on-chain balance validation so the standard insufficient Spending/Savings error appears before coin selection.

Local verification: 193 focused Android tests passed; detekt completed successfully with only unrelated pre-existing findings.

Retested after 5d39cd9.

Enable — still fails. ❌

Toggle Enable payments with contacts → Unknown error, toggle does not stay on. Same staging contact as before (pubky1jy146y751hkgqk9p69ds5cqf461aj5x7c8ptbca5rw6m9asotso). Recording + logs attached.

This is not the noise_public_key inspect-fail anymore. Logs are PrivateUnavailable. In this run I turned the toggle off first; disable cleanup already failed with that error, then re-enable with cleanup still pending fail-closes again. Settings still maps it to Unknown error.

Same user-facing miss on iOS #684 (toast there is Private Paykit is not available).

Steps:

1. Paykit UI on. Profile exists. Staging pubky above saved as a contact (need not be live).
2. Payments with contacts off (or turn it off first).
3. Enable payments with contacts.
4. Toast is Unknown error; toggle stays off.

logs-android.zip

Over-balance — looks good on Android. ✅

Incoming request larger than the wallet: one Insufficient Savings / Spending toast, request stays pending and dismissible. No already in progress loop.

iOS #684 still repeats that toast (see that PR).

Addressed the remaining enable/disable QA path in signed, rebased commit 531578e.

The private setting now reflects the user choice independently of transient transport cleanup or immediate Noise availability:

• Disable commits private sharing off and records failed remote cleanup as durable deferred work instead of restoring the toggle.
• Re-enable supersedes pending removal and prepares saved contacts opportunistically; it no longer requires a live peer or immediate private endpoint publication to keep the toggle enabled.
• Recovery persists the cleanup marker before remote removal and local pruning, so a failure between those stages remains retryable. The cached-publication fallback still recovers older states where the marker was not stored.
• Malformed remote markers remain unusable, and there is still no private-to-public payment fallback.

Regression coverage includes deferred disable cleanup, re-enable with pending cleanup, recovery without a marker, failure after remote cleanup but before local pruning, and total versus partial marker-selection failure. The over-balance behavior that passed the retest is unchanged.

Post-rebase verification: full testDevDebugUnitTest, detekt, and compileDevDebugAndroidTestKotlin pass. The stack is rebased onto current master and all 13 PR commits are signed.