Replace bolt11-signet with a decode-only BOLT11 library

[reneaaron]

Problem

bolt11-signet (1.4.1) is a personal fork of the bitcoinjs bolt11 library that only adds the signet tbs invoice prefix. It was introduced in 7ba28b5 (feat(mutinynet): use bolt11-signet package) for the Mutinynet experiments and has not been published since April 2024.

Because it is a full BOLT11 encoder and signer it pulls in secp256k1 → elliptic, bn.js, lodash, create-hash → sha.js / cipher-base, and an old bitcoinjs-lib → bs58check → base-x. These transitive packages account for most of the yarn audit --groups dependencies findings (see #3624, which refreshes the lockfile as a stopgap). Upstream bolt11 has the same dependency list, so switching back to it would not help.

What the extension actually uses

Only decode(). Runtime call sites read millisatoshis, timestamp, payeeNodeKey, tagsObject.description, tagsObject.payment_hash, and the raw tags list:

• src/common/utils/paymentRequest.ts
• src/common/lib/lnurl.ts
• src/extension/background-script/actions/ln/sendPayment.ts
• src/extension/background-script/actions/webln/sendPaymentOrPrompt.ts
• src/extension/background-script/connectors/{galoy,lnbits,lndhub,nwc}.ts
• src/app/screens/{ConfirmPayment,ConfirmPaymentAsync,Send}/index.tsx
• src/types.ts (PaymentRequestObject type)

encode() / sign() are used only in src/fixtures/paymentRequests.ts and tests to mint test invoices. There are no references to signet anywhere in src/, README, or doc/.

Proposal

Replace bolt11-signet with a decode-only library:

• light-bolt11-decoder — sole dependency is @scure/base, which is already a direct dependency here. It is prefix-agnostic, so signet (lntbs) invoices still decode.
• Alternative: the Invoice class from @getalby/lightning-tools (zero dependencies, already installed transitively via @getalby/sdk), which exposes paymentHash, satoshi, timestamp, description, expiry.

Work involved:

1. Swap the decode() call sites and replace the PaymentRequestObject type in src/types.ts with the new decoder's shape (or a small adapter that keeps the current field names).
2. Replace the encoder usage in src/fixtures/paymentRequests.ts with prerecorded invoice strings.
3. Remove bolt11-signet from package.json.

Expected result: secp256k1, the nested elliptic, bn.js, lodash, and bolt11's create-hash chain disappear from the production dependency tree. Note liquidjs-lib still pulls sha.js / cipher-base / base-x, so the lockfile refresh in #3624 remains necessary.