[#1499] Make milestone release and redirect operations atomic

[greatest0fallt1me]

Summary

• Add durable release/redirect operation records with a unique milestone-scoped logical identity.
• Enforce pending -> submitted -> confirmed and recoverable failed -> submitted transitions with row locks and conditional updates.
• Require confirmation of the exact transaction hash before settlement consumers may mark an operation complete.
• Make duplicate submissions, callbacks, timeout recovery, and process restarts safe and operator-visible.

Implementation details

• Added the settlement_operations migration with status/type constraints, identity and transaction-hash uniqueness, recovery indexes, attempt counts, timestamps, and bounded failure details.
• Added the database adapter for create/get/submit/confirm/fail operations.
• Added a deterministic in-memory ledger mirroring production transitions for worker-level testing and snapshot/restore recovery.
• Reusing an operation key with changed destination, amount, asset, or operation type returns an identity conflict.
• Confirmations cannot advance pending or failed operations and cannot confirm a different transaction hash.
• Documented state transitions, recovery runbook, failure semantics, and trade-offs.

Validation

• npm test -- --runInBand src/services/settlementOperations.test.ts
• Result: 24 tests passed.
• ESLint passed for src/services/settlementOperations.ts.

Closes #1499