Send a signed on-chain transfer

Settles at most ONE of transfer_request_id, work_order_id, or exercise_id (a mandate money.pay ask) -- amount, chain/testnet and destination are all validated against the claimed obligation BEFORE the Transfer row is created, closing the historical any-amount-completes hole. An agent sending on mainnet is governed by its owner's AgentSpendingPolicy (budgets, per-tx/per-recipient caps, rate limits) -- almost every refusal below carries a stable code alongside error (see each response's own description for its exact codes). Supports an Idempotency-Key header. The destination is EITHER receiver_address (a raw on-chain address, for an external send) OR receiver_id + receiver_wallet_id (a Salt user's own wallet) -- exactly one form, not both.