Add authenticated user-directed swap calldata protocol

[1kresh]

Summary

• Adds an authenticated private POST /swap protocol with DISCOVERY, CONFIRM, and BUILD phases for user-directed swaps.
• Discovers exact-input points, confirms an immutable ordered plan, and builds only that persisted confirmation.
• Selects authorization per leg: direct legs return Router-bound SignedSwap calldata (0x9a4568b6); discount legs resolve the exact persisted discount and return DiscountSwap calldata (0x8fa5c671).
• Preserves mixed-leg order, direct nonce indexes from the full persisted plan, per-leg and aggregate floors, capacity domains, one selected deadline, and byte-identical cached retries.
• Returns the minimal Router tuple data (adapter, amountIn, data) with accounting metadata; the solver never submits or broadcasts the transaction.

Validation and failure behavior

• Framework signer authorization and EIP-712 domains are required only for direct legs; configured direct adapters retain startup validation.
• Discount legs validate the persisted ID, adapter, input token, exact physical route/input, current minimum discount, current output floor, both deadlines, and prior nonce invalidation.
• Provider or malformed-payload failures return 502; stale authorization, route, floor, capacity, deadline, or nonce state returns 409.
• Mixed builds are all-or-nothing, and concurrent retries resolve or sign only once through the immutable build cache.

Accepted discount ABI limitation

The existing discount signatures do not bind outer recipient or amount, and the discount entrypoint does not consume its nonce. The returned payload is therefore replayable bearer authorization until its signed deadlines. This limitation is explicit and unchanged by Router/backend validation.

Companion PRs: symbioticfi/rfq-backend#292 and symbioticfi/rfq#21.

Verification

• GOTOOLCHAIN=go1.26.5 go build ./...
• GOTOOLCHAIN=go1.26.5 go test -race -cover ./...
• RFQ package coverage: 77.2%
• GOTOOLCHAIN=go1.26.5 golangci-lint run: 0 issues