private broadcast: enforce sending to unique node ids

Sending more than one transaction to a given node would be a privacy
leak and thus enforce that this is not done. `GetSendStatusByNode()`
assumes unique node ids.

Note that sending more than one transaction to a given address is fine,
if that is done via separate connections, in which case the node ids
would be different.

src/private_broadcast.cpp

@@ -33,6 +33,11 @@ std::optional<CTransactionRef> PrivateBroadcast::PickTxForSend(const NodeId& wil
 {
     LOCK(m_mutex);
 
+    if (GetSendStatusByNode(will_send_to_nodeid).has_value()) { // nodeid reuse, shouldn't send >1 tx to a given node
+        Assume(false);
+        return std::nullopt;
+    }
+
     const auto it{std::ranges::max_element(
             m_transactions,
             [](const auto& a, const auto& b) { return a < b; },

src/private_broadcast.h

@@ -73,7 +73,9 @@ public:
      * Pick the transaction with the fewest send attempts, and confirmations,
      * and oldest send/confirm times.
      * @param[in] will_send_to_nodeid Will remember that the returned transaction
-     * was picked for sending to this node.
+     * was picked for sending to this node. Calling this method more than once with
+     * the same `will_send_to_nodeid` is not allowed because sending more than one
+     * transaction to one node would be a privacy leak.
      * @param[in] will_send_to_address Address of the peer to which this transaction
      * will be sent.
      * @return Most urgent transaction or nullopt if there are no transactions.