feat(rfq): add authenticated taker client

[tvolk131]

Summary

• add the deadcat-rfq-client crate as the authenticated taker-side bridge between the RFQ wire protocol and the venue-neutral client composer
• pin the provider endpoint, authenticated client identity, Liquid chain, policy asset, and required capabilities before accepting quotes
• separate signed-quote authenticity from current liveness, retain expired or locally rejected quotes for durable recovery, and reauthenticate persisted quote evidence after restart
• bind exact user slippage/fee intent and current binary-market context to RFQ quote requests, then map confidential provider inputs, outputs, and blinder roles into a venue-neutral leg
• resolve quote-local identifiers against the final global transaction layout, including nonzero offsets and multiple contributions
• require an explicit provider-blinded → caller-wallet-authorized → journalable execution-attempt transition; raw PSET bytes can no longer be submitted as if they were taker-authorized
• classify every post-dispatch execute failure as ambiguous while preserving the exact attempt for retry and recovery
• tighten RFQ RPC response-state validation and make authenticated expired quote evidence reusable

Safety boundaries

• the production quote API samples the trusted wall clock only after the provider response arrives
• replay and live capabilities share a monotonic clock high-watermark, so an older clone cannot bypass a later liveness or expiry observation
• reservation handles and execution attempts bind the full endpoint, chain, policy-asset, reservation, quote-commitment, timeline, layout, and PSET context
• provider-blinded PSETs are not signing authority; the new authorizer trait is intentionally unimplemented until the caller-owned whole-transaction wallet validator lands
• execution attempts have a versioned serializable record and an unkeyed self-consistency/correlation digest; the digest is explicitly not journal authentication or provider attestation
• a direct-Iroh regression proves that a client timeout can occur while provider work subsequently completes, and that the client returns SubmissionUncertain without consuming the retry payload
• authoritative taker prevout/market revalidation, balancing blinding, taker signing, persistent attempt driving, provider-correlated attempt commitments, signed-result verification, broadcast, and monitoring remain follow-up work and are documented as such

Verification

• cargo fmt --all -- --check
• cargo clippy --locked --offline --workspace --all-targets -- -D warnings
• cargo test --locked --offline --workspace --all-targets -- --test-threads=1
• cargo test --locked --offline --workspace --doc
• focused authenticated direct-Iroh quote → compose → blind → authorize → execute/status and execute-timeout recovery coverage

Stack

This PR is intentionally based on #37 and contains exactly one additional commit. Once #37 merges, this PR can be retargeted to master.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}