refactor(payment): tighten quote-freshness, raise skew to 300s

[mickvandijke]

Summary

• validate_quote_timestamps had an unreachable else arm: when now.duration_since(quote.timestamp) returns Err, quote.timestamp.duration_since(now) necessarily returns Ok, so the "invalid timestamp" path could never fire. Replaced the nested match with SystemTimeError::duration(), removing the dead arm and its misleading error string.
• Replaced Duration::as_secs() > CONST with Duration > Duration::from_secs(CONST). The old form floored fractional seconds, silently widening both windows by up to ~1 s past the documented limits.
• Raised the forward-skew tolerance from 60 s to 300 s and renamed QUOTE_CLOCK_SKEW_TOLERANCE_SECS → QUOTE_FUTURE_SKEW_TOLERANCE_SECS. 60 s was too tight for unmanaged P2P nodes with imperfect clock sync; 300 s gives realistic drift headroom while remaining negligible against the 24 h max age. Past-side skew is intentionally absorbed entirely by QUOTE_MAX_AGE_SECS — there is no separate past tolerance.

No public API change (constant is pub(crate)-equivalent — module-private). Behavior change is limited to which forward-dated quotes are accepted.

Test plan

• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --lib --features test-utils payment::verifier::tests — 44/44 pass
• test_quote_within_clock_skew_tolerance_accepted (30 s future, well within 300 s) ✓
• test_quote_just_beyond_clock_skew_tolerance_rejected updated to 360 s future, now exceeds the 300 s threshold ✓
• test_quote_23h_old_still_accepted — max-age window unchanged ✓
• test_future_timestamp_rejected — still rejects far-future timestamps ✓

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Refactors payment quote “freshness” validation in PaymentVerifier to make timestamp checks precise (sub-second correct), remove dead code paths, and relax forward-clock-skew tolerance for real-world P2P node drift.

Changes:

• Simplifies future/past timestamp handling by using SystemTimeError::duration() and removing an unreachable “invalid timestamp” arm.
• Compares Duration values directly instead of as_secs() to avoid implicit flooring.
• Raises forward-skew tolerance to 300s and renames the constant accordingly; updates related tests/comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.