feat: RealUnit wallet-to-wallet (W2W) gasless transfer flow

[TaprootFreak]

Summary

Phase 2 Baustein 3 — RealUnit wallet-to-wallet (W2W) transfer: send REALU to another wallet, recipient picked via QR scan or manual entry. Implements #684 (umbrella #666).

The transfer is gasless via EIP-7702 — DFX pays gas from a dedicated W2W gas wallet — so the app signs an EIP-712 delegation + an EIP-7702 authorization, exactly like the existing SOFTWARE gasless sell confirm (real_unit_sell_payment_info_service.dart). It reuses eip712_signer.dart / eip7702_signer.dart and the wallet unlock/lock boundary; it is not the bitbox raw-tx path.

Flow (Page + Cubit per step, separate state files):

1. Recipient — scan a wallet QR or paste/type an EVM address; client-side checksum validation for UX only (the API is the final authority). An ethereum: EIP-681 URI is normalized to the bare address.
2. Amount — whole REALU shares (REALU decimals = 0); the available balance is read via the shared balance watcher and the over-balance guard is local UX only.
3. Confirm — review recipient + amount.
4. Process — capability gate (software-only signing) → PUT /transfer → sign EIP-712 delegation + EIP-7702 authorization → PUT /transfer/:id/confirm → success (txHash) / typed failure.

Typed failures rendered as states (no error-string parsing): unsupported wallet (debug/BitBox), signature cancelled, invalid request (API 400/404 — invalid recipient / self-transfer / token-contract recipient / insufficient REALU), and gas-funding-unavailable (API ServiceUnavailable 503 → friendly "temporarily unavailable", REALU untouched).

Scanner reuse (no duplication)

The scanner from #674 was an inline MobileScanner in PayScanPage. Extracted a shared lib/widgets/scanner/qr_scanner_view.dart (the camera/MethodChannel wrapper) and refactored both the pay scan page and the new send recipient page onto it — each flow keeps its own decode logic (LNURL vs EVM address). No scanner code is duplicated.

API / decision authority

Consumes DFXswiss/api#3820 (pair-PR, backend lands first): PUT /v1/realunit/transfer + PUT /v1/realunit/transfer/:id/confirm. The app renders API-signaled outcomes and does not duplicate backend KYC/registration/limit/eligibility logic.

Branch / stacking

Branched from feature/ocp-pay-flow (#674) to reuse the scanner without duplication; PR base is staging. Stacked on #674 (scanner) — review/merge #674 first; this diff will shrink once #674 merges to staging.

Tests / gates

• flutter analyze: 0 issues.
• flutter test --coverage --exclude-tags golden: all pass; 100% scoped coverage on every new file (no coverage:ignore).
• flutter test --tags golden: golden tests + baselines for the new screens.
• dart format (repo config: page_width 100, trailing_commas preserve): clean.

Goldens regenerate pending on the runner: baselines here were rendered locally on macOS and will mismatch the CI runner; the Golden Regenerate workflow is being dispatched so the runner pushes authoritative baselines.

Stays Draft (no ready-for-review, no merge).

[TaprootFreak]

Follow-up hardening complete — corrective round pushed as b0365860.

This closes the residual edge cases from review of the W2W transfer flow:

• Double-transfer: the confirm button guards synchronously against a rapid double-tap, and PopScope keeps canPop true only for the terminal success state — so a system-back during the failure→retry→signing transition can no longer slip through and start a second transfer.
• Recipient parsing: ambiguous or malformed EIP-681 URIs are rejected (exactly one non-empty address query param; parse errors are caught).
• State safety: prepare failures funnel through a single isClosed-guarded emit (no emit-after-close); the registration/KYC-required path always shows the localized message.

Verified locally with the CI commands: flutter analyze → No issues found!; flutter test --coverage --exclude-tags golden → 3042 passed.

Note: CI has not re-run on the latest commits — this PR currently conflicts with its base (feature/ocp-pay-flow), so GitHub cannot produce a merge commit and the pull_request workflow does not fire. It will run once the base is merged to staging and this branch is rebased onto it.

[TaprootFreak]

Review summary — rebase onto updated OCP-pay base + full pr-ready

Rebased the W2W transfer flow onto the updated OCP-pay base (feature/ocp-pay-flow); the 7 feature commits replayed cleanly and only the shared dashboard / routing / ARB integration points needed a union merge (both flows verified to coexist). Then ran the full two-lens review.

Conformity lens — the new send surfaces used Column + Spacer() sticky CTAs instead of ScrollableActionsLayout (the BitBox-untappable-button bug class, blocking per CONTRIBUTING). Migrated the amount / confirm / process-result / recipient surfaces to ScrollableActionsLayout, added responsive-matrix tests (device × text scale, expectNoLayoutOverflow + expectFullyTappable) and catalog entries. That gate surfaced and fixed a latent RenderFlex overflow in the confirm summary rows at textScale 3.0. Also applied the {Resource}Dto naming to the EIP-7702 data DTO and corrected an import ordering.

Logic lens — pay-scan absorption, scanner reuse, routing, and shared-code base-interaction all verified clean. One pre-existing issue — duplicate navigation on repeated QR detection, shared by the Pay and Send scan flows via QrScannerView — is tracked separately in #874, since the robust fix belongs in the shared widget rather than this rebase.

Verified on the build host: flutter analyze clean, send goldens regenerated, responsive-matrix and send test suites green.