feat(ui): add campaign transfer ownership UI

[OpensrcLord]

Overview

Campaign transfer ownership UI + cause card polish, split out from the original combined PR per review feedback. This is the feature half; the observability security fix (issue #566) lives in its own PR.

Related Issues

Closes #577

Changes

Campaign Transfer UI

• [ADD] src/lib/contractClient.ts — 4 new contract functions:
  • getCampaignTransfer(campaignId) — view function to check pending transfer
  • initiateCampaignTransfer(campaignId, newOwner) — creator starts 2-step transfer
  • acceptCampaignTransfer(campaignId) — recipient accepts pending transfer
  • cancelCampaignTransfer(campaignId) — creator cancels pending transfer
• [ADD] src/components/CampaignTransferPanel.tsx
  • Creator view (no pending): Input for recipient address + "Transfer" button
  • Creator view (pending): Shows recipient address + "Cancel Transfer" button
  • Recipient view (pending): Blue banner with "Accept Transfer" button
  • Follows existing patterns: mock support, TransactionLifecyclePhase status callbacks, parseContractError error handling
• [MODIFY] src/app/[locale]/causes/[id]/CauseDetailClient.tsx
  • CampaignTransferPanel wired into the sidebar after VestingReservePanel
• [MODIFY] src/components/WalletContext.tsx
  • Support for the transfer ownership contract calls

Cause Card Polish

• [MODIFY] src/components/CauseCard.tsx — constrained description rendering
• [MODIFY] src/components/ThirdPartyScripts.tsx — widened ScriptStrategy runtime check comment
• [MODIFY] src/__tests__/components/CauseCard.test.tsx — cover description fallback, save button and action failures (56 tests)

Verification

• TypeScript: no type errors
• CauseCard test suite: 56 tests pass
• Rebased onto latest upstream main

Acceptance Criteria (Issue #577)	Status
Creator can initiate transfer with recipient address	Yes
Creator can cancel pending transfer	Yes
Recipient sees accept banner	Yes
Recipient can accept transfer	Yes
Loading, processing, and error states handled	Yes

[sshdopey]

Auto-review failed (API error). Leaving PR for human review.

[OpensrcLord]

Split done per your review feedback, @davidmaronio.

• This PR (fix(security): add auth to observability API routes #784) is now scoped to the metrics-read token auth only — requireMetricsAuth() on the observability metrics and events routes (2 files, +38). Rebased onto current main; TypeScript, Prettier and ESLint are clean on the changed files.
• The campaign transfer UI, CauseCard, ThirdPartyScripts and contractClient changes are now in #1042 — rebased onto current main, CauseCard suite (56 tests) passing, tsc clean.

Both are ready to review.

[davidmaronio]

the transfer panel and contract client work look good and ci is green. two things before merge: please split the walletcontext state/actions refactor (plus the unrelated causecard tests and styling tweaks) into its own pr, this one should stay transfer-only. and in the split itself, the actions usememo only lists connectwithsocial as a dep while also capturing connectwallet and disconnectwallet, which risks stale closures. worth fixing when you extract it.

[sshdopey]

Auto-review failed (API error). Leaving PR for human review.