* feat: added address validation

* Add CLI version validation for Clementine bridge

- Add getVersion() method to ClementineClient to fetch CLI version
- Add CLEMENTINE_CLI_VERSION env variable as required configuration
- Integrate version check into validateNetworkConsistency()
- Fail with clear error if CLI version doesn't match expected version

* Extend correlationId column to support longer values

- Change correlationId from nvarchar(256) to nvarchar(MAX)
- Clementine withdrawal correlation IDs can reach ~816 characters
- Add migration to alter existing column

* fix: improve signature parsing with label-based extraction

Parse withdrawal signatures by their labels (optimistic/operator-paid)
instead of relying on order in the CLI output. Falls back to order-based
parsing with a warning if labels are not found.

* fix: critical Clementine withdrawal safety improvements

- Always save order in checkOrder() to persist correlationId changes
  from intermediate steps (prevents data loss on restart)
- Add idempotency check before withdrawSend() to prevent double cBTC
  burning if process crashes after sending but before persisting state
- Add sentToBridgeAt fallback using order.updated timestamp to ensure
  operator escalation works even if original timestamp is lost

These fixes prevent potential fund loss in multi-step withdrawal
operations where state machine data in correlationId must survive
process restarts.

* fix: add NOT_FOUND status for withdrawal idempotency check

Add explicit NOT_FOUND status to WithdrawStatus enum to distinguish
between "never submitted" and "in progress" withdrawals. This prevents
double cBTC burning if the process restarts after withdrawSend() but
before correlationId is persisted.

* fix: add logging for unexpected withdrawScan CLI output

Log warning when CLI output doesn't match expected patterns instead
of silently returning null. Helps diagnose issues with CLI format changes.

* chore: cleanup

---------

Co-authored-by: Bernd <bernd@dfx.swiss>