feat(leash): complete Phase 8 dashboard

[Blockchain-Oracle]

What changed

• completes the Phase 8 Leash owner dashboard with real owner-scoped receipt list/detail APIs, live Base + Arbitrum float reads, cap-cycle reset context, provisioning status, and revocation controls
• correlates agent x402 outcomes to immutable receipt and transaction evidence while conservatively retaining cap commitment for broadcast transactions that later revert
• adds real PostgreSQL migrations and upgrade-path tests for credentials, precision, cap context, and failed-transaction hashes
• exports the Particle Universal Account public SDK surface and keeps B03/B04 money-moving actions explicitly BLOCKED until the funded live spike
• runs CI for codex/** branches so every phase branch gets hosted verification

Why

Phase 8 needed a production-shaped owner control surface whose numbers and statuses come from authenticated database/RPC sources. The implementation deliberately avoids seeded tenants, fabricated balances, fake receipts, and simulated money movement.

Safety and review

• destructive cancel/nuclear actions require a fresh validated two-network float read; loading, timeout, failure, and retry states remain disabled
• cap reset notices handle genuine missed scheduled periods without treating manual or frequency changes as scheduled resets
• independent implementation review and verification audit finished clear
• authenticated Magic/Zen smoke covered all protected Leash routes; the current owner has no agent, so the UI honestly renders the day-zero BLOCKED provisioning state

Verification

• pnpm lint
• pnpm check:showcase
• pnpm typecheck
• pnpm test — 841 web tests passed, 1 intentionally skipped live case; all monorepo test tasks green
• pnpm build
• pnpm db:check
• fresh PostgreSQL database migrated through all 24 migrations
• live Base + Arbitrum USDC reads against the real Magic-derived address
• live Particle UA V2 / EIP-7702 identity read
• actionlint .github/workflows/ci.yml
• source hard-cap, staged diff, and Gitleaks checks clean

Explicitly blocked

Funded signer provisioning and money-moving top-up/withdraw/rebalance remain visibly disabled until the Phase 0 funded live spike is completed.