Complete BitIntroduction payments and Tor routing

[ekulkisnek]

What changed

• adds durable idempotent transfers for paid introductions and chain fallback
• preserves exact transactions across ambiguous responses and restarts
• pins Tor-only submissions to the selected tunnel
• rejects chain submission when the trusted Tor tunnel is unavailable

Why

BitIntroduction payments must never double-spend on retry, and Tor-only mode must not leak submissions through another route.

Validation

• Rust formatting check
• 31 plain_bitnames tests passed
• 4 plain_bitnames_app tests passed
• targeted idempotency and exact-tunnel coverage passed

[ekulkisnek]

Closing this draft while the implementation is finalized on the preserved fork branch. No commits or branch history are being deleted.