feat(restore): operator-configurable wallet restore policy

How far back a wallet may ask THIS instance to scan on import is an operator
decision — the backfill cost lands on its LWS/node. Add WALLET_RESTORE_POLICY
(create-only | bounded | unlimited, default bounded) + WALLET_MAX_RESTORE_DEPTH_DAYS,
advertise it via /capabilities so the wallet adapts its import UX, and enforce
it at the scan path (xmr/wow register, grin scan): a too-deep start_height is a
ValidationError naming the bound, never the caller's value. Create needs no
check (no tip lookup). Self-sovereignty stays intact at the ecosystem level —
a deeper restore means self-hosting or a looser operator. Fail-closed config
validation; a unit test per policy; OpenAPI drift clean.

src/api/openapi.rs

@@ -67,6 +67,7 @@ use utoipa::OpenApi;
         crate::api::capabilities::ChainCapabilities,
         crate::api::capabilities::ChainCapability,
         crate::api::capabilities::FeatureCapabilities,
+        crate::api::capabilities::RestoreCapability,
         crate::api::prices::PricesResponse,
         crate::api::auth::AuthResponse,
         crate::api::auth::UserInfo,