[2/?] Local reputation: persistence and in-flight replay across restarts

[GeorgeTsagk]

Description

Second part of the local reputation work started in #10919.

Makes the reputation state survive a restart of the node:

• Channel state is persisted in a native SQL table when running with
  db.use-native-sql, one row per channel_id. Nodes on the KV backend get
  no store and keep the in-memory behaviour of [1/?] Local reputation: subsystem core, read only #10919.
• Decay across downtime comes for free: the decaying averages are stored as
  running value plus last update time and restored verbatim, so the first
  read after a restart decays them over the full gap. A restarted manager
  reads exactly what a manager that never stopped would read.
• HTLCs that were in flight during the restart are rebuilt from the switch's
  open circuits before it starts re-forwarding resolutions, with the incoming
  cltv and the accountable signal read back from the commitment HTLC. Their
  in-flight risk is counted again and their settle or fail is scored instead
  of being dropped as unknown. They are scored on the fee our own policy
  requires, like a live forward, capped at the fee the sender offered. The
  original add time and height are not recoverable, so the hold is measured
  from the restart.
• Closed channels are removed from memory and from the store.

Still log-only. Nothing here affects forwarding or the wire. The forward and
resolve benchmarks from #10919 are unchanged, and the new persistence
benchmarks put the periodic flush at about 10 ms per 1000 changed channels on
sqlite, once a minute, off the forwarding path.

The itest restarts the forwarding node with two HTLCs held at the final hop,
one of them accountable, and asserts both are replayed, one is scored as
settled and the other as failed, and that reputation carries across the
restart only with the native SQL store.

Not in scope: resource buckets and any enforcement, which come in later parts. This PR does not affect HTLC routing.

[github-actions]

🔴 PR Severity: CRITICAL

56 files | 5911 additions / 14 deletions

🔴 Critical (11 files)

• htlcswitch/circuit_map.go - HTLC circuit map, core forwarding state
• htlcswitch/interfaces.go - HTLC switch interfaces
• htlcswitch/link.go - HTLC link forwarding logic
• htlcswitch/mock.go - htlcswitch test double, same package as forwarding logic
• htlcswitch/reputation_guard.go - new hook gating HTLC forwarding decisions
• htlcswitch/switch.go - core HTLC forwarding/routing state machine
• server.go - core server coordination, wires reputation manager into startup
• sqldb/migrations.go - registers new DB migration
• sqldb/sqlc/migrations/000016_reputation.up.sql / .down.sql - new schema migration
• sqldb/sqlc/models.go / querier.go / reputation.sql.go - generated DB layer for new migration
• sqldb/sqlc/queries/reputation.sql - new SQL queries backing the migration

🟡 Medium (9 files)

• config_builder.go - wires new reputation config into the config builder
• lncfg/db.go, lncfg/routing.go - new config flags
• log.go - registers new reputation subsystem logger
• reputation/*.go (channel, config, decaying_average, decision, htlc, log, manager, persist, replay, revenue, saturated, sql_store, store) - new standalone reputation/jamming-mitigation package
• reputation_wiring.go - wires reputation manager into the server
• sample-lnd.conf - documents new config options

🟢 Low (36 files)

• docs/release-notes/release-notes-0.22.0.md - release notes
• htlcswitch/circuit_test.go, link_test.go, reputation_hooks_test.go - test-only
• itest/list_on_test.go, itest/lnd_reputation_persistence_test.go, itest/lnd_reputation_test.go - integration tests
• lntest/harness_assertion.go - test harness helper
• reputation/*_test.go, reputation/bench_test.go, reputation/testutil_test.go - test-only
• reputation_wiring_test.go, sqldb/sqlc/sql_store_postgres_test.go, sqldb/sqlc/sql_store_sqlite_test.go - test-only

Analysis

This PR introduces a new HTLC reputation / channel-jamming-mitigation system and wires it directly into the core forwarding path: htlcswitch/switch.go, link.go, circuit_map.go, and interfaces.go are all modified to call into the new reputation_guard.go hook, meaning forwarding decisions are now gated on reputation state. It also adds a new database migration (sqldb/sqlc/migrations/000016_reputation.*) and wires the new manager into server.go startup.

Per the classification rules, htlcswitch/* changes and any sqldb/* migration are always CRITICAL, and this PR touches both, plus server.go directly — so it lands at CRITICAL independent of size. It also independently qualifies for a severity bump (56 files, ~5.9k lines changed, multiple distinct critical packages touched: htlcswitch, sqldb, server.go), though the ceiling is already CRITICAL. This warrants expert review of the HTLC forwarding state machine and the new persistence layer before merge.

---

_{To override, add a severity-override-{critical,high,medium,low} label.}