Reject ambiguous Cashu encodings and invalid proof amounts

Cashu decoding currently replaces malformed UTF-8, sums duplicate CBOR fields, accepts excess base64 padding, and lets a valid proof hide invalid proof amounts in strict /pay decoding. This can display an ambiguous amount or allow a malformed token through the send gate.

Reject ambiguous encodings before extracting a summary and reject invalid proof amounts in strict mode. Permissive display still ignores invalid amounts or renders unsupported V4 data as a generic chip.

Validation: all 13 Cashu decoder tests pass; the same suite has four failures against current main. Added regressions for JSON/CBOR UTF-8, duplicate fields, padding, and mixed valid/invalid amounts. Full unit/lint checks and physical send validation are still pending, so this is a draft. No raw device evidence is included.

Checked open and closed Cashu changes, including the original feature PRs #773/#776 and parity work #935. These parser cases are still present on main and are not fixed in that work.