Audit fixes for SMS tool (5 issues)

- XSS: render from_number/code via textContent, drop innerHTML string concat
- Poll throttle: last_check column + 3s min between SMSPool /sms/check calls
- provider_cost: store REAL + CAST in admin SUM (was silently summing text as 0)
- Atomic debit: _debit() with balance_sats >= ? guard, debit-before-provision,
  refund ledger entry on provision failure (no double-spend window)
- _extract_sms: defensive field parsing (text/body/message/content, number/sender/from)
- admin: add PROVIDER COST card (USD)

templates/sms.html

@@ -155,10 +155,20 @@ select{background:rgba(0,0,0,.4);border:1px solid rgba(255,255,255,.12);color:#f
               d.messages.forEach(msg => {
                 const div = document.createElement('div');
                 div.className = 'sms-msg';
-                div.innerHTML = '<div class="from">FROM +' + (msg.from_number||'?') + '</div>' +
-                  '<div class="body"></div>' +
-                  (msg.detected_code ? '<span class="code-tag">' + msg.detected_code + '</span>' : '');
-                div.querySelector('.body').textContent = msg.body;
+                const fromEl = document.createElement('div');
+                fromEl.className = 'from';
+                fromEl.textContent = 'FROM +' + (msg.from_number || '?');
+                const bodyEl = document.createElement('div');
+                bodyEl.className = 'body';
+                bodyEl.textContent = msg.body || '';
+                div.appendChild(fromEl);
+                div.appendChild(bodyEl);
+                if (msg.detected_code){
+                  const codeEl = document.createElement('span');
+                  codeEl.className = 'code-tag';
+                  codeEl.textContent = msg.detected_code;
+                  div.appendChild(codeEl);
+                }
                 mEl.appendChild(div);
               });
             }