deps: re-sync sdk 0.4.27 -> 0.4.51, boltz-swap 0.3.32 -> 0.3.56

The pin is what stranded 34,882 sats. Signer-rotation support shipped in sdk
0.4.35 on 2026-06-15, three weeks before arkade.computer rotated its signer on
07-04. We were on 0.4.27, which predates it: deprecatedSigners existed there
only as a type and a field mapping, consumed nowhere. Golem was online the whole
cutoff window and still could not migrate.

The two packages move together by necessity — boltz-swap pins the sdk exactly, so
upgrading one alone nests a second copy and duplicates wallet state.

Cost of 24 versions: one field. WalletBalance gained pendingRecovery, and the
test fixture needed it. Nothing else in src/ changed. The only breaking change in
the range (arkfee Estimator.eval -> evaluate, 0.4.40) touches code we do not use.

Verified against a copy of the production wallet db, never production first:

  BALANCE: settled 0, preconfirmed 0, available 0, recoverable 0,
           pendingRecovery 34882, total 34882   vtxos 1

pendingRecovery is the SDK's own name for funds under a deprecated signer past
its cutoff that the server has not swept yet. Counted in total, excluded from
spendable — so /l402/status keeps reporting 34,882.

Starting from the earlier backup that held only the current default contract,
the new SDK found the funds unaided: it re-derives deprecated-signer scripts from
deprecatedSigners and registered the pre-rotation boarding contract by itself.
The recovery contract row inserted by hand on 07-26 was never needed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EDa4J3SuRssUCYJxrR5MKy

Author: ryanthegentry

package-lock.json

@@ -28,8 +28,8 @@
     "vitest": "^4.0.18"
   },
   "dependencies": {
-    "@arkade-os/boltz-swap": "^0.3.32",
-    "@arkade-os/sdk": "^0.4.27",
+    "@arkade-os/boltz-swap": "^0.3.56",
+    "@arkade-os/sdk": "^0.4.51",
     "@hono/node-server": "^1.19.9",
     "@noble/curves": "^2.0.1",
     "@noble/hashes": "^2.0.1",

package.json

@@ -7,6 +7,10 @@ export function walletBalance(overrides: Partial<WalletBalance> = {}): WalletBal
     preconfirmed: 0,
     available: 0,
     recoverable: 0,
+    // Added in sdk 0.4.51: funds under a deprecated signer past its cutoff that the server
+    // has not swept yet. Not spendable until they recover, but still the wallet's money, so
+    // the SDK counts them in `total` and excludes them from `available`.
+    pendingRecovery: 0,
     total: 0,
     assets: [],
     ...overrides,