perf(validator): defer source-balance lookup until after cheap reserve rejections

[anderdc]

What

Move the source-balance lookup in handle_swap_reserve to the last gate before vote_reserve, after the cheap commitment / slippage / already-reserved / cooldown rejections.

Why

For a BTC source, provider.get_balance is an uncached external Esplora/gomaestro HTTP call, and it previously ran before all the in-process/substrate rejections. So every reserve request that was going to be rejected anyway (wrong slippage band, miner already reserved, address on cooldown) still forced one upstream API call first.

Under a reserve spam burst — the kind we see hammering a single UID with dozens of SwapReserve requests/sec — this is a per-request amplification vector: N spam requests = N Esplora calls, even for guaranteed-reject requests. That burns provider quota (and on quota exhaustion the failover eventually returns balance 0, which would false-reject real users) and backs up the axon threadpool (the source of the Nonce is too old aging we observed).

Reordering so the balance call runs only after a request clears every cheap rejection means spam destined for those paths never touches Esplora.

Preserved

• TAO (substrate) balance read still serialises under axon_lock; BTC read stays lock-free — both unchanged, just relocated (keeps the fix(validator): serialize TAO source-balance check under axon_lock #456 invariant: a slow Esplora call can't stall the forward loop).
• All rejection reasons unchanged.

Tradeoff

The balance call now sits between the already-reserved check and the vote, so a concurrent request could reserve the miner during the lookup. That race costs at most one doomed vote_reserve, which the contract rejects atomically — the early-reject guarantee is unchanged. (No pre-vote re-check added: it would conflict with the pin's get_miner_reserved_until read for marginal benefit.)

Test

• Full suite green (691 passed).
• test_tao_source_balance_check_holds_axon_lock updated to build a self-consistent tao→btc quote (derived from the handler's own functions) so it reaches the now-later balance check; the lock assertion is unchanged.