fix(cch): check HTLC expiry delta before sending outgoing payment

[doitian]

Summary

Add a dynamic expiry check when dispatching outgoing payments to prevent fund loss when the outgoing route's total expiry (including all routing hops) exceeds the incoming payment's remaining time.

Problem

Previously, CCH only compared final_tlc_expiry_delta values statically at order creation time. This missed the scenario described in #1000: if there are many routing nodes for the outbound payment, the accumulated tlc_expiry_delta of the entire route can exceed the inbound.final_tlc_expiry_delta, causing the inbound payment to expire before CCH can settle it.

Solution

When dispatching the outgoing payment (after incoming is accepted):

1. Compute remaining incoming time: incoming_final_expiry_delta - elapsed_since_order_creation
2. Allocate half for outgoing: max_outgoing = remaining / 2 (other half reserved for settling incoming)
3. Validate sufficiency: If max_outgoing is less than the outgoing invoice's minimum final expiry delta, fail the order immediately
4. Cap the outgoing route:
   • BTC (LND): Set cltv_limit on SendPaymentRequest
   • CKB (Fiber): Set tlc_expiry_limit on SendPaymentCommand

Tests

• test_send_btc_fails_insufficient_expiry_delta — SendBTC order with insufficient remaining incoming time
• test_receive_btc_fails_insufficient_expiry_delta — ReceiveBTC order with outgoing CKB TLC expiry exceeding available time
• test_send_btc_passes_sufficient_expiry_delta — Verifies valid orders pass the check

Fixes #1000

[Copilot]

Pull request overview

This PR adds a dynamic HTLC/TLC expiry-budget check at outgoing-payment dispatch time to prevent cross-chain fund loss when the total outbound route timelock exceeds the remaining inbound timelock (issue #1000).

Changes:

• Compute remaining inbound expiry time at dispatch time and reserve half for settling inbound after preimage receipt.
• Enforce a route-wide expiry cap on outgoing payments (LND cltv_limit, Fiber tlc_expiry_limit) and fail orders early when insufficient.
• Add/update specs documentation and introduce new actor tests covering insufficient/sufficient expiry scenarios.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

File	Description
docs/specs/cch-expiry-dependency.md	Documents the new dynamic outgoing route-expiry cap and the reasoning behind it.
crates/fiber-lib/src/cch/actions/send_outgoing_payment.rs	Implements remaining-time computation, sufficiency validation, and route-expiry caps for outbound payments.
crates/fiber-lib/src/cch/tests/actor_tests.rs	Adds harness configurability and tests for failure/success cases around the new expiry logic.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[quake]

@doitian need to resolve conflicts