fix(transfer): enforce transfer precision, authorization boundaries, and state-transition invariants

[0dillon]

Description

This PR resolves merge conflicts against latest \main\ and enforces exact precision, authorization boundaries, and robust state-transition guarantees for transfer composition and quotes:

Key Changes

1. Transfer Amount Precision & Overflow Guards (Closes [Quality][High] transfer composition and quotes: amount precision and overflow — QE-2026-08 #1653):

   • Validates transfer amounts using exact non-negative integer string representations (
     awAmountString) and display limits before state transitions.
   • Enforces bounds on numeric and token symbol fields across \AssetDescriptorSchema\ and \EmergencyTransferConfigSchema.
   • Rejects invalid scale, negative values, and overflows before applying state mutations.

2. Authorization & Tenant Capability Boundaries (Closes [Quality][High] transfer composition and quotes: authorization boundaries — QE-2026-08 #1650):

   • Enforces server-derived capability gating via /api/transfer-capability\ and verifies session authorization at review, bind, and submit boundaries.
   • Rejects missing, stale, version-drifted, and cross-tenant identities before mutating state.
   • Ensures rejected, repeated, expired, or failed operations leave no partial, unauthorized, or lingering execution state.

3. State Transition & Concurrency Safety:

   • Cleanly resolves reducer duplicate submission handling and enforces idempotency with event trail preservation (\DUPLICATE_BLOCKED, \REVIEW_STARTED, \SUBMIT_ATTEMPTED, \SUBMIT_SUCCEEDED).
   • Fixes test fixtures and mocks to guarantee resilient client and UI behavior.

Verification

• 
  pm run build\ (
  ext build): Built production bundle with 0 errors.
• 
  px vitest run: 9/9 test files passed (136/136 tests green).

Closes #1653, Closes #1650