feat(spv): verify the chain identity of a server on connect

After the handshake the wallet checks server.features genesis_hash and,
when the profile has checkpoints, the header at the highest checkpoint
not above the server's tip (mainnet shares Bitcoin's genesis, so the
checkpoint is what tells the chains apart). A server on another chain is
refused with WrongChainException and the next candidate is tried. Used by
the GUI, peer discovery, the CLI and the server probe. See ADR 0036.

src/App/ViewModels/MainWindowViewModel.Sync.cs

@@ -215,7 +215,14 @@ public partial class MainWindowViewModel
                     try
                     {
                         var pins = new CertificatePinStore(AppPaths.CertificatePinsPath(Net));
-                        _client = await ElectrumClient.ConnectAsync(h, p, UseSsl, pins, ct);
+                        var connected = await ElectrumClient.ConnectAsync(h, p, UseSsl, pins, ct);
+                        try { await connected.VerifyChainAsync(Profile, ct); }
+                        catch
+                        {
+                            await connected.DisposeAsync();
+                            throw;
+                        }
+                        _client = connected;
                         _client.NotificationReceived += OnServerNotification;
                         _client.Disconnected += _ => Dispatcher.UIThread.Post(() =>
                         {
@@ -428,7 +435,14 @@ public partial class MainWindowViewModel
             try
             {
                 var pins = new CertificatePinStore(AppPaths.CertificatePinsPath(Net));
-                temp = await ElectrumClient.ConnectAsync(h, p, UseSsl, pins);
+                var fresh = await ElectrumClient.ConnectAsync(h, p, UseSsl, pins);
+                try { await fresh.VerifyChainAsync(Profile); }
+                catch
+                {
+                    await fresh.DisposeAsync();
+                    throw;
+                }
+                temp = fresh;
                 lastError = null;
                 break;
             }
@@ -480,6 +494,8 @@ public partial class MainWindowViewModel
     {
         CertificatePinMismatchException cert =>
             string.Format(Loc.Tr("msg.cert.mismatch"), $"{cert.Host}:{cert.Port}"),
+        WrongChainException chain =>
+            string.Format(Loc.Tr("msg.chain.wrong"), $"{chain.Host}:{chain.Port}"),
         _ => ex.Message,
     };