Spend a hashcash stamp only when the request succeeds (closes #158)

A session request refused with 400 or 409, or a +H channel message
refused for membership, a ban or +m, used to spend its stamp, so a
retry with the same stamp was refused as already used.

hashcash.Validator.Validate is split into Check, which spends
nothing, and Claim, which records the stamp; Release undoes a claim.
Session creation checks the stamp first, claims it just before
CreateSession and releases it if CreateSession fails.
SendChannelMessage checks the stamp after the membership, ban and +m
checks.

Model: opus-5-5

internal/service/service_test.go

@@ -24,6 +24,7 @@ import (
 	"sneak.berlin/go/neoirc/internal/config"
 	"sneak.berlin/go/neoirc/internal/db"
 	"sneak.berlin/go/neoirc/internal/globals"
+	"sneak.berlin/go/neoirc/internal/hashcash"
 	"sneak.berlin/go/neoirc/internal/logger"
 	"sneak.berlin/go/neoirc/internal/service"
 	"sneak.berlin/go/neoirc/pkg/irc"
@@ -1056,6 +1057,88 @@ func TestSendChannelMessage_Moderated(t *testing.T) {
 	}
 }
 
+// TestRefusedChannelMessageLeavesStampUnspent checks that a
+// PRIVMSG to a +H channel refused because the sender is not
+// a member, is banned, or has no voice on a +m channel does
+// not spend its hashcash stamp: the operator can then send
+// the same message with it.
+func TestRefusedChannelMessageLeavesStampUnspent(t *testing.T) {
+	const (
+		channel = "#paid"
+		bits    = 2
+	)
+
+	refusals := []struct {
+		name string
+		// refuse stops bob from sending to the channel.
+		refuse func(ctx context.Context, env *testEnv, chID, bobSID int64) error
+	}{
+		{"not a member", func(ctx context.Context, env *testEnv, _, bobSID int64) error {
+			return env.svc.PartChannel(ctx, bobSID, "bob", channel, "")
+		}},
+		{"banned", func(ctx context.Context, env *testEnv, chID, _ int64) error {
+			return env.db.AddChannelBan(ctx, chID, "bob!*@*", "alice")
+		}},
+		{"moderated", func(ctx context.Context, env *testEnv, chID, _ int64) error {
+			return env.svc.SetChannelFlag(ctx, chID, 'm', true)
+		}},
+	}
+
+	body, _ := json.Marshal([]string{"hello"}) //nolint:errchkjson
+
+	for _, refusal := range refusals {
+		t.Run(refusal.name, func(t *testing.T) {
+			env := newTestEnv(t)
+			ctx := t.Context()
+
+			aliceSID := createSession(ctx, t, env.db, "alice")
+			bobSID := createSession(ctx, t, env.db, "bob")
+
+			joined, err := env.svc.JoinChannel(ctx, aliceSID, "alice", channel, "")
+			if err != nil {
+				t.Fatalf("join alice: %v", err)
+			}
+
+			_, err = env.svc.JoinChannel(ctx, bobSID, "bob", channel, "")
+			if err != nil {
+				t.Fatalf("join bob: %v", err)
+			}
+
+			err = env.db.SetChannelHashcashBits(ctx, joined.ChannelID, bits)
+			if err != nil {
+				t.Fatalf("set +H: %v", err)
+			}
+
+			err = refusal.refuse(ctx, env, joined.ChannelID, bobSID)
+			if err != nil {
+				t.Fatalf("refuse bob: %v", err)
+			}
+
+			stamp := hashcash.MintChannelStamp(
+				bits, channel, hashcash.BodyHash(body),
+			)
+			meta, _ := json.Marshal(map[string]string{"hashcash": stamp})
+
+			_, _, err = env.svc.SendChannelMessage(
+				ctx, bobSID, "bob", irc.CmdPrivmsg, channel, body, meta,
+			)
+
+			var ircErr *service.IRCError
+			if !errors.As(err, &ircErr) ||
+				ircErr.Code != irc.ErrCannotSendToChan {
+				t.Fatalf("bob: want ERR_CANNOTSENDTOCHAN, got %v", err)
+			}
+
+			_, _, err = env.svc.SendChannelMessage(
+				ctx, aliceSID, "alice", irc.CmdPrivmsg, channel, body, meta,
+			)
+			if err != nil {
+				t.Fatalf("alice with the same stamp: %v", err)
+			}
+		})
+	}
+}
+
 func TestQueryUserMode(t *testing.T) {
 	env := newTestEnv(t)
 	ctx := t.Context()