peering: a completed-but-unconfirmed invoice leaves the retry set if the processor downgrades its status #1134

Follow‑up from the re‑review of #1087 (N2).

Problem

The retry set for unconfirmed peering settlements is gated on COMPLETED, but the pass writes the processor's status before deciding whether to confirm:

updateInvoiceStatus at src/app/maintenance-worker.ts:250
needsConfirmation (now covering completed‑and‑unconfirmed) at :252

If a settlement rolled back and the processor later reports anything other than COMPLETED — for example an LNbits invoice that has expired — the row is downgraded and immediately drops out of the retry set while confirmed_at is still null. The guarantee added in #1087 therefore only holds for as long as the processor keeps reporting paid, which is exactly the condition that is not guaranteed.