fix(x402): exclude stacked STX from balance checks; check inbox and news payments

[biwasxyz]

Why

Follow-ups from #435, plus two bugs found while getting the full test suite to finish.

What

• Stacked STX. Hiro's stx.balance includes STX locked in stacking, which a transfer cannot move. New spendableStx() subtracts locked; the sponsored check (fix(x402): refuse sponsored payments the wallet cannot cover before signing #435) and the direct-mode gas/price check both use it. Before this, a wallet with mostly stacked STX passed the check and failed at settlement.
• Inbox and news payments. inbox send and aibtc-news file-signal build their own sponsored sBTC transfers outside the engine. Both now call checkSponsoredPaymentBalance before signing.
• Bug: aibtc-news file-signal could not pay. It imported getAccount from wallet-manager, which does not export it, so the paid path threw getAccount is not a function. It went unnoticed because tsc only covers src/. Now imported from x402.service, like inbox does.
• Bug: Bun connection errors were treated as ambiguous. Bun's fetch-backed axios adapter reports a refused connection and a failed DNS lookup as ConnectionRefused, not ECONNREFUSED/ENOTFOUND. requestWasNeverSent did not recognise it, so in direct mode a paid request that never left the machine was reported as "Settlement is ambiguous", and the duplicate guard and spend entry were kept, refusing an immediate retry for up to 15 minutes. Added ConnectionRefused to the not-sent set; verified the codes Bun 1.1.43 actually produces (TLS errors already use Node's codes).
• Test harness: the x402 test file never finished. After the paid: hang test, server.close() waited forever on the held connection (closeAllConnections() does not drop it under Bun). The fake now tracks sockets and destroys them on close. This is why bun test src/lib appeared to hang; CI does not run the tests, so nobody saw it.

Verification

• bun run typecheck, bun run validate (204/204) pass; inbox/inbox.ts and aibtc-news/aibtc-news.ts also typecheck clean on their own (the news file had one error before: the getAccount import).
• bun test src/lib: 167 pass, 0 fail, 16 s (previously hung). New tests: spendableStx, sponsored STX price with locked STX (refused), direct gas with locked STX (refused). The existing "never reaches the server" test was failing under Bun and now passes.
• Skill tests (hodlmm-flow, inscription-queue-watcher, launkr, signing, stacks-alpha-engine): 49 pass, 1 fail. The failure is pre-existing: stacks-alpha-engine imports tiny-secp256k1, which is not in package.json.
• Not exercised: a live mainnet payment, or a live inbox or news payment.

Follow-up worth considering

CI runs typecheck/validate but not bun test, and tsc only covers src/, which is how both bugs above shipped. Adding bun test src/lib to CI and widening the typecheck would catch them.

🤖 Generated with Claude Code

[biwasxyz]

Review: rebased onto main (after #437/#438). Signatures verified for both new call sites; old aibtc-news getAccount import confirmed broken. Typecheck clean; bun test src/lib 174/174 in 17s (no longer hangs). LGTM.