fix: prevent false success for rejected on-chain sends

[ovitrif]

Parent: #1207
Source: Pubky marketplace Bitkit team brief
Counterpart: synonymdev/bitkit-ios#717

Scope

• Verify whether Android shares the stale-tip/non-final success condition.
• Apply the cross-platform root-cause fix or document evidence that the Android path is unaffected.

Acceptance criteria

• A rejected non-final transaction is never represented as sent.
• Accepted sends retain current behavior.

[ovitrif]

Blocked by synonymdev/ldk-node#112.

Android confirms the same false-success path as synonymdev/bitkit-ios#717 on LDK Node 0.7.0-rc.63:

• LightningService.send calls sendToAddress / sendAllToAddress and receives a Txid.
• LightningRepo.sendOnChain immediately creates sent metadata and activity from that Txid.
• AppViewModel immediately opens the Bitcoin Sent result.
• LDK Node only enqueues the transaction at that point; Electrum, Esplora, or bitcoind submission runs later, and rejection/timeout cannot reach the caller.

An Android-local acceptance check is not safe: the binding exposes neither the raw transaction nor a transaction-keyed broadcast result, locally persisted wallet state is not backend acceptance, and wallet sync races the independent broadcast queue.

The production fix belongs in LDK Node. Android should remain In progress until a released binding exposes accepted versus rejected submission and this app consumes that contract. No Android files were changed.