move the wallet's chain source out of env and into the ui

WALLET_ESPLORA_URL was the one wallet setting an owner actually has to change — off a
public explorer that rate-limits and sees every address, onto their own indexer — and it
was the one they could only change with a shell and a restart. It now lives in
service_connections under 'esplora' and is edited at Wallet -> Settings -> Chain source,
probed against /blocks/tip/height before it is stored.

The URL joins the backend fingerprint, so re-pointing rebuilds every on-chain backend and
drops the gap-limit scan taken through the old endpoint. /_health probes what the wallets
actually use rather than the built-in default, and /_officer/config no longer reports a URL
it cannot know.

Also two receive-screen defects the Blockstream 429 exposed: a query error rendered as
"No address available", and the "new address" button called refetch() on the ?peek=true
query, so it re-fetched the same address instead of advancing the index.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -53,9 +53,9 @@ VAULT_STORE_KEY="<generate with: openssl rand -base64 32>"
 # HEADSCALE_USER=officer
 
 # ── Bitcoin wallet (officer-wallet) ─────────────────────────────────────────────────────────────
-# Chain data source for the self-custodial on-chain wallet. Any Esplora-compatible API works —
-# mempool.space by default, or point it at your own node's esplora/electrs when you run one.
-# WALLET_ESPLORA_URL=https://mempool.space/api
+# The chain data source is NOT here — it is configured from the app, at Wallet → Settings → Chain
+# source, and stored per owner. Any Esplora-compatible API works (electrs, esplora, mempool.space);
+# it defaults to the public mempool.space until you set one.
 # WALLET_NETWORK=bitcoin          # bitcoin | testnet | signet | regtest
 #
 # How long an unlocked wallet stays unlocked, in seconds. Default 900 (15 min). The root key is held