feat(lnd): rotate Lightning macaroons from the dashboard, and stop stranding BTCPay

Rotating LND's macaroons was an SSH-only script, which in practice meant it did
not happen — while a macaroon is a bearer token with no revocation and no expiry,
so anything that ever read one keeps the ability to spend until they are
replaced. Settings → Lightning credentials now does it behind the node password,
shows a step checklist, and refuses to report success unless it has confirmed the
node identity and channel census are unchanged.

Three findings from performing a real rotation on a dev node, each fixed here:

1. BTCPay was left holding a dead credential, silently. Its connection string
   carries the macaroon INLINE (LND's datadir is owned by its container subuid,
   so btcpay cannot bind-mount the file), and the daemon only regenerates that
   secret when LND's TLS cert thumbprint changes — which macaroon rotation does
   not touch. Result: btcpay up, LND up, both healthy, every Lightning payment
   failing, nothing anywhere saying why.

2. Rewriting the secret is not enough to fix it. `secret_env_hash` makes the
   change visible as env drift, but the reconcile loop runs `ExistingOnly` at
   boot AND periodically, and there it deliberately leaves running
   restart-sensitive apps untouched — observed once per tick for half an hour on
   the dev node. So this reuses FED-07's `credential_rotated` carve-out via a new
   default-no-op `ContainerOrchestrator::mark_credential_rotated`, on the same
   reasoning: restart sensitivity protects apps that are working, and this one is
   working only in appearance. The shell script cannot reach an in-process flag,
   so it removes the container and lets desired-state recovery rebuild it.

3. LND stayed locked forever on a loaded node. The unlocker is only served after
   channel.db/graph.db/wallet.db open, measured at 2m38s on a box running 30
   containers; the unlock helper gave up at ~60s. That is not a harmless retry —
   reconcile records the post-start hook as failed, restarts LND, and the slow
   open begins again, so the wallet never opens and every LND-dependent app stays
   broken. The not-ready budget is now ~10 minutes; a genuinely wrong password
   still exits on the first pass via `all_rejected`.

Safety properties worth not regressing:
- No macaroon content in any response, error, log line or the polled progress
  feed — digests and byte counts only.
- Rotation unlocks via a new `unlock_existing_wallet_no_wipe`, so there is no
  code path from "rotate my credentials" to `recreate_wallet_destructively`. A
  wallet whose password this node lacks fails the rotation with the wallet intact.
- Channels are compared as active+inactive totals, not `num_active_channels`,
  which legitimately dips after any restart while peers reconnect.
- Backup verified by file count before anything is deleted.

Verified: cargo check + fmt clean, 6 new unit tests and the 6 existing
container::lnd tests pass, vue-tsc clean, and the built bundle contains the three
new RPC method names (the frontend build can silently no-op).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md

@@ -134,12 +134,21 @@ The operator's call, recorded here so it is not silently re-litigated: **no LND
 rotation, and no Bitcoin RPC password rotation.** The reasoning was that there is no
 evidence of exploitation and the vulnerability is being closed rather than lived with.
 
-`scripts/security/rotate-lnd-macaroon.sh` stays in the tree as a tool. It has been
-exercised in detect mode only, and has never rotated anything on any node. Its ordering
+`scripts/security/rotate-lnd-macaroon.sh` stays in the tree as a tool. Its ordering
 guard (refuses to rotate on a binary lacking the fix) remains the right shape for whenever
 rotation is wanted — including for the Bitcoin RPC password, which has no equivalent tool
 yet.
 
+**Amended 2026-08-08.** This section said the script "has never rotated anything on any
+node"; that is no longer true. A rotation was performed on a development node while
+responding to the BTCPay Server advisory (that node had been running an affected
+`btcpayserver:2.3.9`), and it exposed a gap the script did not cover: BTCPay's inline copy
+of the macaroon was left stranded, so its Lightning payments failed silently while both
+apps reported healthy. Rotation is now a first-class, password-confirmed dashboard action
+that repairs that copy as part of the run — see
+[`LND-MACAROON-ROTATION.md`](LND-MACAROON-ROTATION.md). The fleet decision recorded above
+is unchanged: no fleet-wide rotation for this leak.
+
 What this decision accepts: any macaroon or RPC password read through either hole before
 it was closed stays valid. That is a deliberate, informed trade, not an oversight.