fix(transfer): enforce transfer quote binding and request key idempot…

[Appsoft1000]

Description

Resolves #1652 by implementing transfer quote binding and request key idempotency within the emergency transfer subsystem (meridian-web).

Key Implementation Details

1. Quote & Request Key Binding:

   • Extended EmergencyTransferConfig and ConfirmationPayload to include quoteId, quoteHash, requestKey, and nonce.
   • Updated deriveBindingKey() to incorporate all entropy sources into the deterministic binding key (bk_<hash>).

2. Idempotency & Replay Protection:

   • useEmergencyTransfer tracks completed operations in an internal operations registry (completedOperationsRef).
   • Safe Retry: Re-submitting with the exact same request key and payload parameters returns the cached txHash deterministically without re-executing the transaction provider.
   • Conflict Protection: Re-using a request key with altered payload parameters (e.g. modified amount or recipient) triggers a CONFLICTING_KEY_REUSED event and halts execution.

3. Payload Immutability & Validation:

   • bindConfirmation() freezes the derived ConfirmationPayload using Object.freeze() and validates it against ConfirmationPayloadSchema.
   • Prevents runtime property tampering prior to transaction submission.

4. UI Audit Trail:

   • Updated EmergencyTransferReviewPanel to display Quote ID, Request Key, and Nonce metadata.
   • Handled config_changed and idempotency failure states gracefully in EmergencyTransferDialog.

Testing Strategy

• Unit test suite expanded to 76 tests covering happy path, payload immutability, expiry, config drift, duplicate submission, provider rejections, safe retries, and conflicting key reuse.
• All vitest tests pass cleanly (76 passed).

Closes #1652