task-28 fix4: trivial cost-preview gate + job polling token

1. ui.js: _scheduleCostPreview() now gates on _TRIVIAL_RE before scheduling
   the /api/estimate fetch. Greeting-pattern text shows '0 sats' badge locally
   and never makes a network call. Same regex as edge-worker.js _isGreeting().

2. payment.js: startPolling() GET /api/jobs/:id now attaches X-Nostr-Token
   header on every poll cycle via getOrRefreshToken(). Completes consistent
   X-Nostr-Token coverage across all job/session API calls.

the-matrix/js/payment.js

@@ -163,7 +163,9 @@ function startPolling() {
   async function poll() {
     if (!currentJobId) return;
     try {
-      const res  = await fetch(`${API_BASE}/jobs/${currentJobId}`);
+      const token = await getOrRefreshToken('/api');
+      const pollHeaders = token ? { 'X-Nostr-Token': token } : {};
+      const res  = await fetch(`${API_BASE}/jobs/${currentJobId}`, { headers: pollHeaders });
       const data = await res.json();
       const { state, workInvoice, result, reason } = data;
 

the-matrix/js/ui.js

@@ -117,9 +117,18 @@ async function _fetchEstimate(text) {
   }
 }
 
+// Fast trivial heuristic — same pattern as edge-worker.js _isGreeting().
+// Prevents /api/estimate network calls for greeting messages on every keypress.
+const _TRIVIAL_RE = /^(hi|hey|hello|howdy|greetings|yo|sup|hiya|what'?s up)[!?.,]?\s*$/i;
+
 function _scheduleCostPreview(text) {
   clearTimeout(_estimateTimer);
   if (!text || text.length < 4) { _hideCostPreview(); return; }
+  // Skip estimate entirely for trivially local messages — zero network calls
+  if (_TRIVIAL_RE.test(text.trim())) {
+    _showCostPreview('answered locally ⚡ 0 sats', '#44dd88');
+    return;
+  }
   _estimateTimer = setTimeout(() => _fetchEstimate(text), 300);
 }