[UTXO-BUG] reject empty-input non-minting transactions

[createkr]

Summary

This PR fixes a critical UTXO validation bug where non-minting transactions with empty inputs could bypass conservation checks and create funds from nothing.

Root cause

In node/utxo_db.py, the conservation check in apply_transaction() was gated by if inputs, so transactions with inputs=[] skipped the value-conservation path entirely. The same gap existed in mempool_add().

What changed

• Added a strict allowlist so only authorized minting transaction types may use empty inputs
• Rejected empty-input transfer and unknown transaction types in apply_transaction()
• Rejected the same class of transactions in mempool_add()
• Added focused regression tests covering:
  • empty-input transfer rejection
  • empty-input unknown-type rejection
  • valid mining_reward preservation
  • mempool rejection for empty-input transfer

Validation

Updated tests in node/test_utxo_db.py to cover the exploit and the allowed minting path.

Scope

• node/utxo_db.py
• node/test_utxo_db.py

Payout Wallet

RTC1d48d848a5aa5ecf2c5f01aa5fb64837daaf2f35