OCP-pay client: defense-in-depth hardening follow-ups

[TaprootFreak]

Surfaced while hardening #674; deferred as out of that PR's scope.

1. Pin the ZCHF token locally: the pay-leg validates tx.to/token against the server-provided unsigned.tokenAddress only. The app has ZCHF asset ids (251/418) but no local per-chain ZCHF contract address to pin against — all addresses come from the backend. Add hard-coded ZCHF contract addresses per chain and validate the pay-leg token against them, so a compromised/MITM'd backend can't redirect the transfer.
2. Bind the amount to the user-confirmed value: the settlement amount is compared against server metadata; bind it to the amount the user actually confirmed.
3. Client swap idempotency on a lost broadcast response: if broadcastSwapTransaction's response is lost or the page closes mid-request, _swapCompleted stays false and a new scan can start a second swap. Persist the swap-id/attempt state and reconcile an unclear prior swap before starting a new one (may need backend idempotency support — see DFXswiss/api swap-metadata/atomicity issues).
4. Show the actually-executed buffered swap before confirm: the quote displays ~100% of the pay amount but a buffered (~103%) swap executes; re-confirm on any amount/merchant change.