fix(deps): bump ln-service to ^59.2.5 and lightning to ^12.2.4 - #773

Upgrade the LND client libraries in core/api to eliminate the last
vulnerable copy of the `invoices` BOLT11 parser from the dependency
tree and pick up current LND support:

- ln-service: ^57.26.1 -> ^59.2.5
- lightning:  ^10.26.1 -> ^12.2.4 (aligned with ln-service 59.2.5's
  own pinned lightning@12.2.4)

Security motivation: ln-service 57.x pinned invoices@4.0.0 and
lightning 10.x pinned invoices@4.0.0 as well, so the previous
invoices bump (ded0687) still left an unpatched parser in the tree.
After this change the lockfile contains only invoices@6.0.5 (core/api
direct + ln-service) and invoices@6.0.0 (lightning's pin) - both
include the duplicate payment-hash first-wins fix
(alexbosworth/invoices@b30a012) and the v6.0.2-6.0.5 validation
hardening. invoices@4.0.0 is fully eliminated.

Breaking-change review (ln-service 57 -> 59, lightning 10 -> 12):
- Node.js >= 22 required (ln-service 58/lightning 11 dropped Node 18;
  ln-service 59.0.5/lightning 12.0.4 dropped Node 20): satisfied by
  the Node 24.19.0 toolchain from 077fed7.
- LND 0.19 and below no longer supported: blink runs
  lightninglabs/lnd:v0.20.2-beta in dev/docker-compose.deps.yml and
  quickstart/docker-compose.yml, and ln-service 59.2.5 explicitly
  supports LND 0.20.2.
- channel_capacity in payment hops eliminated: no production-code
  usage in blink. The only reference was a payViaRoutes fixture in
  test/integration/services/lnd-service.spec.ts, which now drops the
  field. The test asserts an error path against a deliberately bogus
  route (fake channel/pubkey), so its intent is unchanged.
- API surface used by blink is stable across these majors: lightning
  named exports (payViaPaymentDetails, payViaRoutes, createHodlInvoice,
  settleHodlInvoice, cancelHodlInvoice, deletePayment, getInvoice(s),
  getPayment(s), getFailedPayments, getPendingPayments, getChannels,
  getClosedChannels, getChainBalance, getChannelBalance,
  getChainTransactions, getPendingChainBalance, getPendingChannels,
  getWalletInfo, authenticatedLndGrpc, unauthenticatedLndGrpc,
  getWalletStatus) and lnService.probeForRoute, the only ln-service
  default-export call site (src/services/lnd/index.ts:474).
- Also picks up fixes in between, notably lightning 12.2.1
  (subscribeToInvoices ignores HTLCs not accepted to the invoice) and
  57.27.3/10.26.5-era short final-CLTV payment allowance.

Verification (Node v24.19.0 dev shell):
- pnpm install --lockfile-only / pnpm install: ln-service@59.2.5,
  lightning@12.2.4, invoices@6.0.5 resolved; no invoices@4.0.0,
  lightning@10 or ln-service@57 references remain in pnpm-lock.yaml
- core/api tsc --noEmit: clean
- full core/api unit suite (with dev/core-bundle/dummy-env.json as
  injected by the buck2 jest_test target): 129/129 suites, 1516
  passed, 3 skipped, 0 failed

Caveat: integration tests require live LND/bitcoind and were not run
locally. The buck2 //core/api:test-integration target should run in
CI before merging, including the edited lnd-service.spec.ts fixture.