Claim Withdraw

Initiate an embedder USDC claim from custody → personal address.

Returns {withdrawal_id, status, circle_transfer_id, network} on success. status is processing once Circle has accepted the transfer; the eventual on-chain settlement (and base_tx_hash) arrives via Circle's transfers.confirmed webhook — out of scope for this PR (deferred per design).

Session discipline (2026-08-08)

This handler used to carry db: AsyncSession = Depends(get_db). That pins a writer-pool connection for the whole request, and _circle_create_transfer below is an httpx POST to Circle with a 20s timeout — so a slow or hanging Circle held one of the pool's 8 writer connections for up to 20s per in-flight claim. Same shape as the six pool-exhaustion SEVs (PRs #657 / #658 / #674 / #677 / #678 / #694); the per-request statement_timeout does not bound it, because the time is spent outside any query.

The split is a natural fit here because the money ordering already demanded it: the withdrawal row is COMMITTED before the Circle call (so a Circle timeout can't lose the audit trail) and both post-call branches re-SELECT the row by id. So phase 1 ends exactly where the commit already was, and phases 3a/3b are the re-SELECTs that already existed — now on a fresh session. No lock is held across the external call in either the old or the new shape (the FOR UPDATE on the balance row is released by the phase-1 commit), and the ordering of every gate, log line, status code and response field is unchanged.