feat(restore): operator-configurable wallet restore policy

How far back a wallet may ask THIS instance to scan on import is an operator
decision — the backfill cost lands on its LWS/node. Add WALLET_RESTORE_POLICY
(create-only | bounded | unlimited, default bounded) + WALLET_MAX_RESTORE_DEPTH_DAYS,
advertise it via /capabilities so the wallet adapts its import UX, and enforce
it at the scan path (xmr/wow register, grin scan): a too-deep start_height is a
ValidationError naming the bound, never the caller's value. Create needs no
check (no tip lookup). Self-sovereignty stays intact at the ecosystem level —
a deeper restore means self-hosting or a looser operator. Fail-closed config
validation; a unit test per policy; OpenAPI drift clean.

.env.example

@@ -68,6 +68,18 @@ GRIN_NODE_API_PASS=
 GRIN_NODE_FOREIGN_API_URL=http://127.0.0.1:3413/v2/foreign
 GRIN_NODE_FOREIGN_API_SECRET=
 
+# ── Wallet restore (import) policy ────────────────────────────────────────
+# How far back a wallet may ask THIS instance to scan on import. The backfill
+# cost lands on your LWS/node, so it is your call; it is advertised via
+# /capabilities so the wallet adapts its import UX. Self-sovereignty is
+# preserved — a user needing a deeper restore runs their own instance or picks
+# an operator with a looser policy.
+#   create-only — new wallets only (scan starts at the tip)
+#   bounded     — restore up to WALLET_MAX_RESTORE_DEPTH_DAYS behind the tip
+#   unlimited   — any restore height (the natural choice for self-hosting)
+WALLET_RESTORE_POLICY=bounded
+WALLET_MAX_RESTORE_DEPTH_DAYS=365
+
 # ── Feature flags (each feature ships in the open core, toggled per deployment) ──
 # The wallet client reads GET /api/v1/capabilities and greys out disabled features.
 FEATURE_PRICES=true