feat(machine): durable dispense-report outbox to spirekeeper (ADR-005 §2)

Every cash-out now produces one report_dispense — on success as well as
failure — and the machine does not stop sending it until spirekeeper
acknowledges it.

state.db gains a dispense_reports table (migration v13 → v14): the report
is written INSIDE recordTransaction's SQLite transaction, alongside the
transactions row, so a crash between the two cannot lose it. Rows carry
attempts / last_attempt_at / last_error / acked_at. Three IPC calls
(pending / ack / note-attempt) expose it to the renderer.

The store builds the report when a cash-out reaches complete,
dispenseFault or outOfCash: txid, payment hash, dispense_confirmed,
error / error_code / raw_code / error_class, per-denomination requested
vs dispensed vs rejected, the per-bay cassette record verbatim, and
counts_uncertain. The success report is what lets the server capture
(distribute) the settlement; the failure report is what puts a customer
on the owed-cash worklist instead of leaving the only record on the ATM.

Delivery is at-least-once: a flusher drains pending rows after each
persist, on relay (re)connect, and every 60 s, acking only on an OK reply
and backing off 30 s · 2^attempts (capped 1 h) otherwise. While
spirekeeper has not registered the RPC every send fails the same way; the
backoff keeps that quiet and the rows wait — this half ships first.

The lightning service exposes reportDispense; the function pointer is
set at all three lightning-init sites so the flusher works on every path.

apps/machine/electron/main.ts

@@ -31,6 +31,9 @@ import {
   setCashOutHold,
   clearCashOutHold,
   type CashOutHold,
+  pendingDispenseReports,
+  markDispenseReportAcked,
+  noteDispenseReportAttempt,
   markStatePublished,
   resetStatePublishWatermark,
   resetForRepair,
@@ -578,6 +581,22 @@ ipcMain.handle('state:set-cash-out-hold', (_event, hold: CashOutHold): CashOutHo
   return setCashOutHold(hold)
 })
 ipcMain.handle('state:clear-cash-out-hold', (): boolean => clearCashOutHold())
+
+// Dispense-report outbox (ADR-005 §2) — at-least-once to spirekeeper
+ipcMain.handle('state:pending-dispense-reports', (_event, limit?: number) =>
+  pendingDispenseReports(typeof limit === 'number' ? limit : 20)
+)
+ipcMain.handle('state:ack-dispense-report', (_event, txid: string): boolean => {
+  if (typeof txid !== 'string' || !txid) throw new Error('Invalid txid')
+  return markDispenseReportAcked(txid)
+})
+ipcMain.handle(
+  'state:note-dispense-report-attempt',
+  (_event, txid: string, error: string | null): void => {
+    if (typeof txid !== 'string' || !txid) throw new Error('Invalid txid')
+    noteDispenseReportAttempt(txid, typeof error === 'string' ? error.slice(0, 512) : null)
+  }
+)
 ipcMain.handle('state:mark-state-published', (_event, unixTimestamp: number): void => {
   markStatePublished(unixTimestamp)
 })