feat: prompt Lightning credential rotation after the 2.4.2 security fix; 2.4.2:0 → 2.4.2:1

[MattDHill]

Summary

2.4.2 patches an actively exploited vulnerability, but patching does not undo access an attacker already took. Everything BTCPay could reach on a pre-2.4.2 build should be treated as exposed, and for the Lightning backends that is actionable — so the up migration raises a critical task against whichever backend btclightning names:

btclightning	Task target	Rotates
LND	lnd → revoke-macaroons	The admin macaroon BTCPay reads off the mount
CLN	c-lightning → revoke-runes	Any rune mintable through the admin RPC socket

Both tasks are gated on the backend being the configured one and its package being installed. The second guard is load-bearing: a critical task stops the source service and is cleared only when the target service runs the action, so raising one for an absent package would leave BTCPay unstartable short of a force-start.

Two exposures the migration deliberately does not try to cover, documented in the release notes and instructions.md instead:

• An install that pointed at a node and later switched away is indistinguishable from one that never did, so those users are told to rotate anyway.
• A hot on-chain wallet generated inside BTCPay has keys that cannot be rotated at all — those funds have to move.

Version bumped rather than folded into 2.4.2:0 so installs that already took :0 from the alpha deploy still receive the prompt.

Dependency floors

dependencies.ts floors lnd at >=0.21.1-beta:11 and c-lightning at >=26.6.6:9, up from :4 and :1. Neither action existed in usable form before those releases — LND's was named recreate-macaroons and only deleted the macaroon files, leaving the root key that signs them in place, so it revoked nothing (lnd-startos#177); revoke-runes did not exist (cln-startos#185). Without the floors a user could be stopped by a critical task pointing at an action that does nothing.

Merge order: both sibling PRs must land, and reach the branches package.json pins, before this one builds.

Test plan

• With LND selected, update from 2.4.2:0; confirm BTCPay stops and shows a critical task pointing at LND's Revoke Macaroons
• Run that action; confirm the task clears, BTCPay starts, and Lightning invoicing still works with the new macaroon
• Repeat with CLN selected, against Revoke All Runes
• With None/External selected, confirm the update raises no task and BTCPay starts normally
• With LND selected but LND uninstalled, confirm no task is raised and BTCPay is not stranded
• With an LND older than 0.21.1-beta:11 installed, confirm the dependency floor surfaces rather than the task pointing at an ineffective action

🤖 Generated with Claude Code