test: harden suite — remove dev_skip masking + publisher preflight

[TaprootFreak]

Problem

The api_remote suite was reporting "33 passed" while critical paths were silently skipped. Empty publisher wallet → every mint returned 503 → dev_skip!() macro masked 5xx as "ok" → CI stayed green on a broken DEV. Coverage Gate and deploy-dev's API E2E became green stamps instead of real signals.

User feedback: "das spricht aber nicht für unser testsetup! ich bin enttäuscht von dir!" — fully justified.

What this PR does

Removes silent-skip masking (BLOCKER fixes)

• All 4 dev_skip!() blocks on is_server_error() in api_remote.rs — mint, send_commit's mint/send/commit — gone. 5xx now hard-fails.
• dev_skip!() on /api/username/claim 503 — gone.
• dev_skip!() on /health/ready non-200 — replaced with assert_eq!.
• dev_skip!() on balance never observed within 60s — replaced with assert!.

Removes scanner-lag retry stopgaps

• The two SEND_RETRY_DEADLINE retry loops on Unable to get merkle proofs / Unable to get mmr inclusion proof 422s (PR test(api_remote): retry second mint on scanner-lag 422 #83) are gone. Event-driven scanner from PR feat(scanner): event-driven chain ingestion (replace Esplora polling) #87 makes them obsolete.
• send_commit_roundtrip_moves_balance now uses a single poll_balance_at_least wait before send. If the scanner regresses, the wait fails — no silent masking.

Operational preflight (NEW)

• GET /health/publisher endpoint at server.rs:1270 — reads PUBLISHER_KEY, derives Taproot address, queries Esplora UTXOs, returns { address, utxo_count, total_sats }. 503 on Esplora error (no fabricated empty response).
• deploy-dev.yaml preflight step probes /health/ready + /health/publisher BEFORE the API E2E job. Job fails with clear "publisher wallet too low (utxos=N, sats=M) — top up" on utxos < 1 OR sats < 50000.

Hardens determinism

• mint_handler_concurrent_mint_during_proof_returns_503: replaced 200ms sleep with tokio::sync::Notify barrier under #[cfg(test)]. Deterministic, no timing race.
• commit_with_valid_signature_fails_broadcast_returns_503: wiremocked Esplora (200 on /address/utxo, 400 on /tx). Asserts exactly 503. No more accept-either.

Hardens contracts

• fetch_capabilities uses .expect() for all 4 capability fields. Missing fields are now contract-regression errors, not silent feature-off.
• feature_skip!() panics when CI=true env is set. Catches accidentally-dropped --all-features in workflows.

Adds fresh-state sanity

• assert_minting_balance_in_bounds helper: 0 < balance <= BOOTSTRAP_MINTING_BALANCE. Catches impossible states (unauthorized re-seed, unexpected wipe) without tripwiring CI on every push-after-reset (the deploy-dev push trigger doesn't run reset_state).

Value-bearing assertions

• Send response: 32-byte length + non-zero on account_state_hash, output_coins_root. Proof_id > 0.
• LNURLp: min_sendable >= 1, max_sendable >= min_sendable.
• State tests: dropped redundant is_ok() before unwrap().
• Many is_some() shape checks replaced with .expect() + value checks.

Hygiene

• tokio::time::sleep(60s) in test handlers replaced with std::future::pending::<()>().await (no timing risk).
• tempfile::tempdir() instead of ad-hoc tempdir + manual cleanup.
• Deleted proof_id_one_returns_200_or_404 — accept-either status was tautological.
• Comment blocks on #[ignore] heavy-proof test and lock-poisoning tests' nextest isolation requirement.

Tier-3 / deferred

• Three TODO: comments in account_server.rs:147,170,416 — tracked separately, out of scope.
• B5 proof_id == 1 pin — explicitly deferred (proof store ID grows across DB lifetime, same constraint as the minting balance bound).

Behavioral impact

After this PR merges, the deploy-dev workflow's API E2E against DEV job will fail loudly when:

• The DEV publisher wallet is below 50000 sats (preflight catches it)
• Any mint/send/commit returns 5xx (no more silent skip)
• Scanner regresses on inscription ingestion (wait fails instead of retry-loop)
• DB unavailable for username claim (no silent skip)
• DEV state is impossibly inconsistent (balance > bootstrap)

Top-up procedure: send sats to the publisher address reported by GET /health/publisher.

Test plan

• CI green (Lint, Heavy Tests, Coverage Gate)
• Deploy DEV preflight rejects an empty-publisher state with a clear error
• After publisher topup: API E2E green end-to-end
• PR Release: develop -> main #18 (Release: develop -> main) auto-updates with green checks