staticaddr: support multiple receive and change addresses - #1218

Associate every deposit with the static address parameters that created
it. This lets restored deposits recover the correct script and signing
keys instead of assuming the legacy root address.

Create receive and change addresses from locally derived client keys
while reusing the server key and expiry from the legacy seed. Persist,
import, and activate each script before returning it to callers.

Rebuild the active address index on startup and serialize issuance
without blocking address reads. Import only scripts missing from lnd,
and accept duplicate-import errors only when they identify the expected
Taproot output key.

Look up each newly discovered wallet UTXO by script and persist the
matching active-address parameters on the deposit. Reject unknown
scripts before allocating the timeout sweep address.

Use the per-deposit parameters when constructing the FSM, sign
descriptor, and unilateral expiry sweep so derived-address recovery uses
its owning script and key.

Multi-address loop-ins sign and construct transactions from the
parameters attached to each deposit and their dedicated change address.
The legacy root address fields therefore became write-only, but
populating them could still abort signing, sweep handling, or recovery
when the root lookup failed.

Remove those fields and lookups, select the FSM from the protocol
version persisted with the swap, and set that version before
constructing new state machines. Keep the root-parameter lookup used by
autoloop expiry calculation and add regression coverage for recovery and
unsupported persisted versions.

Create a fresh static address for partial-withdrawal change and identify
it in the confirmed transaction through its active change-family script,
without assuming output order or count. Record withdrawn and change
amounts by script identity.

Keep all withdrawal outputs in the PSBT without separate signing
metadata while preserving full-withdrawal behavior.

Let loop static deposit create and fund a fresh receive address through
lnd SendCoins. Validate funding arguments before address creation and
require explicit confirmation unless --force is set, including for
non-interactive and first-use deposits.

Allow NewStaticAddress RPC callers to fund a requested existing static
address by resolving it through the active script index. Expose the
nested request through the client RPC, require swap:execute permission,
and cover the CLI new-address and daemon existing-address funding paths.
Regenerate RPC and CLI documentation.

Include the owning static address in every deposit RPC response and CLI
listing. Users can distinguish deposits created by different receive and
change addresses without reconstructing scripts externally.

Calculate blocks until expiry from each deposit owner instead of the
legacy root address, and reject deposits whose owning parameters are
missing. Centralize deposit response conversion and update generated RPC
artifacts, regression coverage, and command replay fixtures.

The CLI previously recognized an uninitialized static-address seed by
searching arbitrary gRPC error text. Any wrapping or wording change
could suppress the L402 backup warning before a user funded a newly
derived address.

Map ErrNoStaticAddress to codes.NotFound at the RPC boundary and
classify that status in the CLI. Retain compatibility with older daemons
only for an exact Unknown-status message, avoiding the broad substring
match, and cover both sides with regression tests.

A static-address account can now receive deposits across multiple
derived addresses, so the singular summary field can no longer describe
the current receive address. Removing or repurposing field 1 would break
existing clients.

Keep the wire value as the legacy/root derivation address, formally
deprecate it, document the expiry as the shared CSV delay, and direct
CLI users to derive a fresh receive address. Rename the server locals to
make the compatibility behavior explicit and regenerate protobuf and
Swagger artifacts.

Cover per-deposit address ownership and operation-specific change
outputs across the shared SQL persistence boundary. Reconstruct the
deposit, loop-in, and withdrawal stores to verify ownership and change
metadata survive restart.

The sweep request handler only compared the number of prevouts the
server sent against the number of sweep inputs. A list of the right
length could still contain duplicate outpoints or reference outpoints
the sweep doesn't spend. The prevout fetcher then returns nil for an
input and NewTxSigHashes panics on the nil dereference, taking down
loopd on a malformed server request.

Reject duplicate prevouts while building the prevout map and require a
prevout for every sweep input before computing sighashes.

Rename the legacy key family and address-manager parameter alias, use
root terminology consistently, and consolidate wallet UTXO listing.
Keep key-family values and the underlying script parameters unchanged.

Document script map keys, issuance helpers, and test invariants. Include
the output script in missing-parameter errors, preallocate address store
results, and remove the constant-value test. Update CLI and RPC docs.

Keep NewStaticAddress address-only and move wallet funding into the new
FundStaticAddress RPC. Require wallet:fund alongside swap:execute and
loop:in so existing swap or address-URI macaroons cannot authorize
wallet funding. Explicit grants for the new RPC remain supported.

Preserve new-address and existing-address funding behavior, route the
static deposit CLI through the new RPC, and regenerate all bindings.
Reserve the removed experimental fields and document macaroon upgrades.

Exercise the production interceptor with signed and expired macaroons,
and cover address-only calls, funding validation, request preservation,
existing-address funding, and recovery after a wallet broadcast failure.

Require exactly one legacy static address when deposits exist before
migration 22 assigns their address IDs. Use a temporary CHECK constraint
shared by SQLite and PostgreSQL; databases without deposits remain
valid.

Cover valid backfills, missing and ambiguous ownership, unchanged schema
and data on rejection, and retry after repair and migration-version
reset. The existing framework still marks a rejected migration as dirty.

Encode listing addresses directly from their canonical P2TR scripts,
validating the script shape and using the configured network. This
avoids rebuilding Taproot trees and aggregating keys for every record
without introducing a cache.

Check encoding against full reconstruction on three Bitcoin networks
and reject malformed or non-Taproot scripts.

Quote selected deposits with one exact active-set lookup, retaining
presence, state, duplicate and expiry checks without rendering history.

Refresh deposits before taking the unspent response snapshot and filter
against active Deposited records. Historical database rows cannot revive
outputs removed during reconciliation or return stale confirmations.

Keep the lowest-ID active address alongside the script index so receive
and change issuance can find the root without scanning all addresses.
Publish the cached root only after successful activation and update it
under the same mutex as the index.

Cover restart recovery and repeated import failures so caching cannot
make an unavailable root appear ready.

Read wallet UTXOs outside the map lock, then match their scripts
directly against the active address index under a short lock. This
removes the full-index allocation and copy on each poll while
preserving confirmation bounds and allowing address activation
during the wallet RPC.

Test filtering across addresses and verify wallet RPCs do not hold
the map lock.

Load persisted addresses in bounded pages using an ascending ID cursor
during startup and root recovery. Read wallet watches once and publish
the complete runtime index only after every page and import succeeds.
The existing bulk-read API remains available for compatibility.

Test sparse IDs, page boundaries, failed-page recovery and restart
behavior, including the SQL query on SQLite and PostgreSQL.

Replace the issuance mutex with a context-aware gate so queued callers
can cancel without disturbing the current issuer. Keep root creation,
recovery and derived issuance serialized and retryable. A private mutex
now explicitly guards the active script index and root.

Test canceled root and derived waiters, subsequent progress and
concurrent first callers sharing one root.

Remove the blank line before the closing brace flagged by CI. This is
formatting only; test behavior is unchanged.

The deposit expiry sweep passed only the client pubkey to lnd. After a
wallet restore lnd has not yet re-derived the static-address key, so
its pubkey lookup misses and falls back to locator (0, 0), producing an
invalid timeout-path signature. Pass the deposit address' key locator
so lnd derives the signing key directly for root, receive, and change
deposits.

Document fresh receive-address derivation, lazy seed initialization,
funding-address lookup hardening, and the swap:execute permission
required by address creation. Regenerate the CLI, gRPC, Swagger, and
man-page documentation and add feature, breaking-change, and recovery
release notes.