fix(spend): unblock SpendRecord persist + clean tool result (solders typing tighten)

[acedatacloud-dev]

Summary

Two bugs in _confirm() (the post-send_raw_transaction confirmation
loop in api/core/spend_executor.py) caused every successful on-chain
spend to fall over before persisting the SpendRecord and returning a
result to the MCP caller. The chain side was actually fine — both bugs
hit after send_raw_transaction returned a tx signature, so USDC
moved on-chain but the DB never saw it, the agent saw a tool exception
error, and the next spend attempt would fail with NonceReplay because
the in-DB nonce counter never advanced past the on-chain last_nonce.

Two bugs, both modern-solders typing tightening

Bug 1 — Signature not str

status = await rpc.get_signature_statuses([signature])
# TypeError: argument 'signatures': 'str' object cannot be converted to 'Signature'

solana-py >= 0.34 / solders no longer accepts the base58 string here,
needs an actual Signature object.

Fix: wrap on entry: Signature.from_string(signature).

Bug 2 — TransactionConfirmationStatus enum not hashable

if s.confirmation_status in {"confirmed", "finalized"}:
# TypeError: unhashable type: 'solders.transaction_status.TransactionConfirmationStatus'

The enum value can't be looked up in a set of strings, even when its
string repr matches. (Older solders returned a plain string here, which
silently worked.)

Fix: coerce to lowercase short-name string before membership check:
str(s.confirmation_status).lower().rsplit(".", 1)[-1] — works against
both TransactionConfirmationStatus.Finalized (enum) and "finalized"
(plain string from older versions).

Live verification

Three real on-chain spends from devnet vault
9d36b255-0efd-4b12-9d74-304cdc0c0e0d (allow only api.acedata.cloud,
1 USDC daily, 0.1 USDC per-call):

try	tx	result before fix	after fix
1	2gPpot9G...Yyf6aE	tool exception (Bug 1), but USDC moved 4.00 → 3.99	n/a
2	(different sig)	tool exception (Bug 2), USDC 3.99 → 3.98	n/a
3	249u8Pion...3y3D	n/a	clean isError: false, returns tx + nonce + Solscan, USDC 3.98 → 3.97

After the fix, aceguard_history shows the spend, aceguard_balance
returns balance_usdc=3.97 spent_today_usdc=0.02 daily_remaining_usdc=0.98,
and the on-chain vault ATA balance matches the DB exactly.

The first two spends are real on-chain transfers that recorded nonce=1
and nonce=2 in the program's Policy account but didn't persist a
SpendRecord — that's an operational issue, not a code bug, and is out
of scope here. Future work could add a _confirm outer try/except that
inserts a SpendRecord even if the post-confirm path explodes, so the
chain and DB never diverge again.

Verification

• uvx ruff check api/core/spend_executor.py — clean
• Live E2E against https://x402guard.acedata.cloud/mcp/<TOKEN> —
  third spend returned cleanly with finalized tx + Solscan URL
• aceguard_history now lists the spend with full metadata
• aceguard_balance daily counter ticked up correctly

Pairs with #18 (scheme:"exact") and #19 (CLI demo + README rewrite)
to make the full chain MCP -> aceguard_spend -> on-chain Anchor program -> SpendRecord persisted -> tool result returned work end-to-end on
the live x402guard.acedata.cloud devnet instance.