feat(addressbook): opt-in save dialog for new external recipients

[BitHighlander]

Summary

When a manual send goes to an address that isn't already a saved contact, a dialog now pops up after broadcast:

• Headline "New external address" + a "Funds are leaving your wallet" warning
• Shows the recipient address (identicon + chain icon)
• Asks "Save this address to your Address Book?" with an optional label field
• Save records the contact and stamps the date added; Not now leaves it out of the book

This makes saving opt-in. Previously every external recipient was silently auto-saved (shown as "Unlabeled" in Saved recipients) and a subtle inline label box was the only prompt.

How it works

• recordOutbound still anchors an external row on send to carry outbound tx-history, but now leaves it saved_at = NULL (history-only, hidden from the book/picker) and reports whether the recipient is unsaved.
• The book view and send-screen picker (listAddressBook) only surface explicitly-saved contacts (savedOnly).
• Saving (popup, or the manual Add address dialog) stamps saved_at. The Address Book row shows "Added <date>".
• Additive saved_at column via guarded ALTER TABLE; a one-time backfill marks existing labeled or manually-added rows as saved so nothing visible disappears on upgrade. Unlabeled auto-recorded recipients become history-only.

Files

• bun/db.ts — saved_at column + migration/backfill, recordOutbound opt-in semantics, addExternalEntry stamps saved_at, getAddressBookList savedOnly filter, row mapping.
• bun/index.ts — broadcastTx returns recipientUnsaved; listAddressBook external = saved-only.
• shared/types.ts — savedAt, savedOnly, recipientUnsaved.
• mainview/components/SaveRecipientDialog.tsx — new modal.
• mainview/components/SendForm.tsx — trigger dialog post-broadcast (replaces inline prompt).
• mainview/components/AddressBookView.tsx — "Added <date>" line.
• i18n/locales/en/addressbook.json — new source strings.

Test plan

• Send to a brand-new address → dialog appears; Save with a label → contact appears in Saved recipients with the date; verify it shows in the send picker next time.
• Send to a new address → Not now → address does not appear in the book (but the send still completes).
• Send again to a previously-saved contact → no dialog.
• Existing users: previously-labeled contacts still visible after upgrade; previously-auto-saved unlabeled recipients no longer clutter the list.
• Passphrase/hidden wallets still skip address-book writes.

[BitHighlander]

Follow-up commit: Address Book is now wallet-agnostic (00ce3dca)

During testing in a hidden (passphrase) wallet, the entire Address Book came back empty — every address-book RPC blanket-returned [] for passphrase sessions, so no device wallets or contacts loaded and sends couldn't be saved.

Per product decision, the Address Book is treated as public, non-secret data (watch-only wallet addresses + saved contacts) that is independent of which wallet is active:

• Reads (listAddressBook) de-gated; own (cross-device) + external (cross-wallet) load in any session. Only seedOwnFromCache (a write) stays standard-only.
• add/update/delete/history de-gated; mutations act globally by id (wallet_id retained as provenance/dedup only).
• broadcastTx: api_log stays standard-only (tx deniability), but the address-book capture now runs in hidden sessions too, so recipients can be saved from a hidden-wallet send.

Security note for reviewers: this intentionally moves the Address Book outside hidden-wallet deniability — a contact saved while in a hidden wallet is visible from the standard wallet. api_log and balances writes remain gated, so tx-activity logging is unaffected.