feat(rfq): add inventory-aware quote engine

[tvolk131]

Summary

• add a transport-free inventory-aware quote engine for configured collateral ↔ YES/NO directions
• support exact-in and exact-out requests with normalized rational rates, checked integer arithmetic, direction-correct rounding, user amount guards, and optional input-asset venue fees
• deterministically select fresh available provider inventory with bounded input counts, dust-aware change policy, and a bounded exact-subset fallback
• produce confidential provider payment/change destinations and a symbolic provider contribution compatible with the client venue model
• atomically reserve the exact quoted inputs with an allocation-revision compare-and-swap, bounded live-quote admission, expiry cleanup, and exact durable idempotent replay across restart
• bind request semantics, pricing revision, wallet snapshot evidence, selected prevouts, output roles, fee policy, and provider recovery metadata into validated durable quote state
• update the README, RFQ state-machine ADR, and liquidity roadmap to distinguish this internal quote artifact from a future authenticated signed wire quote

Why

PR #28 established the authoritative wallet inventory, confidential destination, and committed-job signer capabilities. This PR builds the next layer over that boundary: a quote request can now be priced against fresh durable availability, converted into one venue-neutral transaction contribution, and reserved without races or ambiguous replay.

The quote engine deliberately remains transport-free. FirmQuote is an internal unauthenticated artifact, not a provider-signed network quote. Concrete market-data pricing, final-PSET validation, wallet/RPC/HSM implementations, authenticated networking, signing orchestration, relay, and chain reconciliation remain later milestones.

Safety properties

• only collateral-to-outcome and outcome-to-collateral pairs explicitly enabled for a configured binary market are quoteable
• exact-in uses floor rounding; exact-out uses ceiling rounding; all arithmetic and taker bounds fail closed
• pricing receives only redacted aggregate inventory, not outpoints, openings, wallet locators, keys, or the recipient
• quote selection uses only a fresh complete wallet snapshot intersected with durable Available state
• the final durable write rechecks the allocation revision and every quoted inventory binding before exposing a quote
• quote-path work is bounded by the current wallet snapshot rather than growing linearly with append-only inventory history
• provider receive/change destinations cannot alias by script, blinding key, or wallet locator, and recovery capabilities are excluded from public quote data and diagnostics
• exact idempotent retries replay the original durable quote without repricing, regenerating destinations, or reserving inventory again
• expired, cancelled, committed, or signed replays remain terminal and never resurrect inventory

Storage compatibility

The provider database remains disposable preproduction state. Schema and private record-layout versions intentionally remain 1; local databases created by prior alpha builds must be deleted and recreated. A real migration policy is required before provider storage is treated as production data.

Validation

• nix develop .#default --command just ci-checks
  • generated-contract verification and formatting
  • strict workspace Clippy with warnings denied
  • 300 workspace tests passed; 6 intentionally skipped
  • all workspace doc tests passed
  • WASM build check passed
• 67 focused RFQ-provider tests cover pricing and rounding, reverse directions, multi-input and dust-aware selection, confidential output/blinder roles, exact restart replay, terminal expiry replay, quota backlog cleanup, stale allocation races, historical inventory scaling, destination non-reuse, and client venue-model conformance
• independent final reviews found no remaining merge blocker

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}