#29278 Wallet: Add `maxfeerate` wallet startup option

• Cap transaction feerates independently from total fee limits on wallet transactions
• Prevent accidental high feerates on small transactions while still allowing large transactions

Adds a `-maxfeerate` wallet startup option (defaulting to 0.10 BTC/kvB) to cap the maximum fee rate the wallet will pay on transactions. It decouples the existing `-maxtxfee` absolute fee cap from feerate validation, updates `BroadcastTransaction` to check both fee and feerate limits independently, and adds a `MAX_FEE_RATE_EXCEEDED` error type to distinguish errors across wallet and RPC interfaces.

Problem: Previously, `-maxtxfee` was ambiguously used both as an absolute transaction fee cap and as a sanity check for fee rates (#29220). Users who configured high total fees to allow multi-input transactions had no protection against accidental high fee rates on small transactions, while users setting low total fees could not broadcast larger low-feerate transactions.

P2 · fund safety

• P2 because it fixes an issue where total fee limits were ambiguously used as feerate limits
• Protects users from accidental high feerates on small transactions without blocking large transactions

P2 because it fixes an existing defect (#29220) where `-maxtxfee` conflated total fee amounts with fee rates. Decoupling the two gives users protection against fat-finger feerates on small transactions while still permitting large transactions within the absolute fee budget.

Membership: Adds a new wallet configuration option `-maxfeerate` and enforces feerate caps in `CreateTransactionInternal`, `feebumper`, and `sendall`.

Factors: security/stability 1, bug 1, performance 0, user value 2, leverage 1

P3 · cleanup

• P3 because it adds a dedicated error code to distinguish feerate caps from total fee caps
• Benefit is limited to clearer error diagnostics for RPC callers

P3 because it introduces a dedicated `MAX_FEE_RATE_EXCEEDED` error code and replaces ambiguous error messages in `sendrawtransaction` and related calls, clarifying failure causes for RPC callers.

Membership: Updates `BroadcastTransaction` signatures and error reporting across RPC calls including `sendrawtransaction` and `submitpackage`.

Factors: security/stability 0, bug 1, performance 0, user value 1, leverage 0

• Ready for review, with clean code, passing CI, and all prior review comments addressed

Code is clean, CI passes, and all reviewer feedback including recent test additions for sendall bump fee handling has been addressed.

Author status: active

Resolved concerns:

• Differentiating error messages between absolute fee and feerate limits (josibake, murchandamus)
• Startup checks when -maxtxfee or -maxfeerate conflict with -minrelaytxfee (josibake, murchandamus, achow101)
• Virtual size estimation discrepancies causing broadcast failures after wallet creation (maflcko, mzumsande)
• sendall and feebumper omitting bump fees of unconfirmed inputs when evaluating the feerate cap (polespinasa)

• Broad agreement on decoupling total fee limits from feerate caps
• Support for independently constraining fee totals and feerates (murchandamus)
• Reviewed and approved across iterations (josibake, achow101, furszy)
• Approved following fixes to unconfirmed input bump fee handling (polespinasa)

Strong: broad consensus on decoupling maxtxfee from maxfeerate; latest push ACKed by polespinasa, earlier commits ACKed by murchandamus, josibake, achow101, and furszy.

Multiple maintainers and reviewers supported the concept and implementation over several rounds of iteration. All major feedback around startup checks, fee calculations, and coin selection edge cases has been addressed and tested.

• Concept ACK from murchandamus: notes value of independently constraining inputs via maxtxfee and feerate via maxfeerate
• Concept ACK and review ACK from josibake
• ACK from achow101 and furszy on earlier revisions
• ACK from polespinasa on latest head after fixing sendall bump-fee edge case

Review verdicts (DrahtBot): 1 (+4)

• ACK: polespinasa
• Stale ACK: josibake, murchandamus, achow101, furszy

Enables:

• Follow-up GUI configuration for broadcast feerate limits

208 lines under test/bench/ci.

• test/functional/wallet_bumpfee.py +60/-2
• src/wallet/wallet.cpp +35/-13
• test/functional/wallet_sendall.py +43/-0
• test/functional/wallet_send.py +31/-0
• src/wallet/test/wallet_tests.cpp +16/-5
• test/functional/wallet_fundrawtransaction.py +14/-6
• src/node/interfaces.cpp +7/-11
• doc/release-notes-29278.md +17/-0
• src/node/transaction.cpp +8/-8
• src/rpc/mempool.cpp +3/-9
• test/functional/rpc_rawtransaction.py +9/-3
• src/wallet/wallet.h +9/-2
• test/functional/rpc_psbt.py +6/-4
• src/wallet/feebumper.cpp +8/-1
• src/wallet/rpc/spend.cpp +6/-2
• test/functional/wallet_create_tx.py +4/-4
• src/wallet/spend.cpp +6/-1
• src/qt/psbtoperationsdialog.cpp +4/-1
• src/common/messages.cpp +3/-1
• src/qt/walletmodel.cpp +2/-2
• src/interfaces/chain.h +2/-0
• src/interfaces/node.h +1/-1
• src/interfaces/wallet.h +1/-1
• src/node/transaction.h +2/-0
• src/qt/sendcoinsdialog.cpp +1/-1
• src/wallet/interfaces.cpp +1/-1
• src/dummywallet.cpp +1/-0
• src/node/types.h +1/-0
• src/test/fuzz/kitchen_sink.cpp +1/-0
• src/wallet/init.cpp +1/-0

PR #29278 introduces a `-maxfeerate` startup option for the wallet (defaulting to 0.10 BTC/kvB) and enforces it across transaction creation, fee bumping, and transaction broadcast. It resolves #29220 by decoupling feerate limits from absolute transaction fee limits (`-maxtxfee`), protecting users against fee rate overpayment on small transactions without impeding large transactions. The change also adds a `MAX_FEE_RATE_EXCEEDED` error to distinguish feerate caps from absolute fee caps in RPC responses. Review is in a strong state: multiple contributors previously ACKed the approach, and the latest iteration resolving unconfirmed bump fee accounting has been ACKed.