feat(transaction-pay-controller): add generic signature steps to server pay strategy

[matthewwalsh0]

Explanation

The server pay strategy previously supported only on-chain transaction steps. Certain provider flows (e.g. perps withdraw via Relay/HyperLiquid) require an off-chain EIP-712 signature step submitted to a provider endpoint before any on-chain work happens. This change extends the server strategy to support a flat steps array containing both transaction and signature steps.

The execution model is now a strict three-phase sequence per quote:

1. Signature steps — sign typed data with the user's key and POST the result to the provider endpoint. Two signatureFormat values are supported: queryParam (appends ?signature=… to the endpoint URL) and rsv (sends split r/s/v fields in the request body). Signed with quote.request.from so account-override flows — where the delegating EOA differs from the sending account — work correctly.
2. Transaction steps — validate source balance via live RPC, build params (including any prepends for post-quote or payment-override flows), then dispatch to the gasless execute path or TransactionController. Payment-override calls are prepended before relay steps at submit time; post-quote flows prepend the original transaction, wrapped in a delegation tx when an account override is active.
3. Status polling — unchanged.

Source token balance validation is skipped for HyperLiquid source flows (no on-chain debit from the user) and post-quote flows (funds come from the Safe after the original transaction executes).

Quote re-evaluation is extended to fire when txParams.to or requiredAssets changes on a transaction, not just txParams.data, so perps flows that rewrite the destination address trigger a fresh quote.

References

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

High Risk
Changes payment submission, EIP-712 signing, balance validation, and batch transaction construction for server intents—including perps withdraw and money-account flows—where mistakes could block or mis-route user funds.

Overview
Extends the server pay strategy so quote steps can mix EIP-712 signature steps with on-chain transaction steps, then runs them in order: sign typed data (using quote.request.from for account override), POST to the provider (queryParam or rsv), build/submit transaction batches (with live balance checks and Money Account / post-quote prepends), then poll intent status as before.

Quote & perps: Server step types are discriminated by type: 'transaction' | 'signature'. Signature-only quotes zero source network fees like gasless. Hyperliquid withdraw requests (isHyperliquidSource) normalize source chain/token/amount in normalizeServerPerpsRequest, use exact-input quoting, skip gasless/delegation on HyperCore source, and skip balance validation at submit. Money Account post-quote quotes inject override calls + transfer into the server quote body via processMoneyAccountPostQuote.

Controller: Quote refresh now also triggers when txParams.to or requiredAssets change, not only txParams.data.

^{Reviewed by Cursor Bugbot for commit c75fcc1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c83e4c2. Configure here.}