fix: harden pay against double-settlement and expiry

src/guards.rs

@@ -0,0 +1,12 @@
+//! Payment settlement guards (issue #8).
+
+/// Returns error if invoice already settled or past expiry.
+pub fn assert_can_pay(settled: bool, expiry_unix: u64, now_unix: u64) -> Result<(), &'static str> {
+    if settled {
+        return Err("already settled");
+    }
+    if now_unix > expiry_unix {
+        return Err("expired");
+    }
+    Ok(())
+}