Co-sign and relay a prepared 2-of-3 Safe transfer

safe_tx_hash must be a transfer this Safe prepared (and not yet submitted) and device_signature D's signature over it. Needs X-Passkey-Token from a passkey assertion bound to action tss_sign and the SafeTx hash (lowercase hex, no 0x). The vault reads the destination, amount and nonce from the prepared row, recomputes the hash, re-runs the sanctions screen on the destination, checks D's signature and the on-chain nonce, records the send in the spend ledger at its value (so it counts toward daily caps), adds V's signature last, and relays: the owner's server-custody Ethereum treasury wallet (not an owner) pays gas, deploying the Safe through the pinned factory first if needed, then submitting execTransaction. 400 when that wallet lacks gas on the chain; 409 if the nonce moved or the transaction was already submitted. Audited multisig_safe.executed; fires wallet.transfer.sent.