Support on-chain bitcoin payments (issue #109) using the payments-rs
OnChainProvider backed by the same LND wallet as the Lightning node.

- lnvps_db: PaymentMethod::OnChain, ProviderConfig::OnChain(LndConfig),
  list_subscription_payments_by_method, unique index on
  subscription_payment.external_id (txid de-dupe)
- Settings::get_onchain() mirrors get_node(); provider is required and
  injected into SubscriptionHandler like the Lightning node
- Payment creation derives a fresh receive address (external_data);
  external_id stays empty until the deposit txid is known
- OnChainPaymentHandler watcher: correlates deposits by address,
  de-dupes by txid (at-least-once stream -> exactly-once), pro-rates
  partial/late/over-payments and inserts new pro-rated renewal payments
  for deposits to already-settled addresses
- API: onchain payment method, ApiPaymentData::OnChain { address },
  admin payment method config support
- MockDb::update_subscription_payment now mirrors all MySQL columns

The quote only fixes the price in the subscription's currency, never the
BTC rate. When a deposit is discovered, time credited is pro-rated by the
value received at the current rate:

  time_value * received_msat * rate_now / (expected_msat * rate_quoted)

For BTC-denominated subscriptions this reduces to the plain msat ratio.
The current rate is recorded on the settled payment, so address-reuse
renewals also price against the latest settle. PricingEngine::get_ticker
is now public for the watcher.

…utpoint

Per review:

- Discard the quote when a deposit is discovered (Detected, 0-conf) and
  re-generate time/tax/fee/rate from the received amount through
  PricingEngine::get_cost_by_amount - the same path as LNURL top-ups.
  Confirmed then just settles, so time-to-confirm never matters.
  Subscriptions without a VM (no amount->cost API) fall back to scaling
  the original quote by value at the current rate.
- Key deposits by the standard outpoint {txid}:{vout} instead of txid
  alone: one tx can pay several watched addresses. Requires payments-rs
  0.5.0 which exposes vout on ChainPaymentUpdate.
- PricingEngine::get_ticker made public for the fallback path.

Lifecycle test now exercises the full on-chain flow with real nodes:

- 14d happy path: renew?method=onchain derives a real address from LND,
  lnd-payer sends coins, a block is mined and the API's chain watcher
  settles the payment; expiry advances and the settled payment records
  the real txid:vout outpoint
- 14e partial payment: half the quoted sats settles with exactly the
  received msats recorded and ~half an interval credited
- 14f address reuse: a further deposit to the settled address
  auto-creates a new paid renewal payment
- Falls back to admin-complete when the docker stack is unavailable

Fixes a latent bug: the compose-file path in the docker helpers was
relative but cargo runs tests with the crate dir as CWD, so pay_invoice
had been silently falling back to admin-complete and lightning e2e never
actually paid through LND. Both lightning and on-chain now settle via
the real payer node (path resolved from CARGO_MANIFEST_DIR).

Drop the finished onchain-payments work file and all other work files
marked complete (basic-firewall, dns-db-refactor, e2e-integration-tests,
fw-inkernel-src-rate, referral-program-apis,
vat-snapshot-and-vm-payment-retirement); in-progress files remain.