feat: support multisig transfers

[cw35]

Summary

• support transfers from legacy and Safe multisig groups with separate --senders and --sender-threshold source flags
• use --trace as create-or-join identity: create and sign a new transfer, or continue signing an existing one
• add signature cancellation/unlock commands for both flows, plus legacy action-request cancellation
• validate API responses and raw transactions before signing, and make concurrent creators converge on the same transfer

Commands

• mixin-cli transfer ... --trace ... --senders ... --sender-threshold ...
• mixin-cli transfer cancel ... (aliases: unlock, cancel-signature)
• mixin-cli transfer cancel-request --request ...
• mixin-cli safe transfer ... --trace ... --senders ... --sender-threshold ...
• mixin-cli safe transfer cancel --trace ... (aliases: unlock, cancel-signature)

For legacy transfers, every signer supplies the same transfer fields because the legacy API has no lookup-by-trace endpoint. Existing Safe requests can be continued with --trace alone.

Test coverage

Added focused tests for deterministic signer ordering, exact-balance input selection, signed-output recovery, request and raw-transaction validation, malformed external UTXOs, duplicate/non-member signers, JSON receiver decoding, amount precision, and command registration.

Verification

• go test ./...
• go test -race -vet=off ./...
• go vet ./cmd/safe ./cmd/transfer
• go build plus CLI help smoke tests
• git diff --check origin/master...HEAD

Self-review also fixed a legacy output-selection TOCTOU race and a Safe create/read race before this PR was opened.

Documentation

• README.md: documented legacy and Safe multisig transfer, join-signing, signature cancellation, and legacy request cancellation workflows.

[cw35]

Follow-up self-review fixes in 541b134:

• bind legacy and Safe API raw transactions to the payload confirmed by the user before signing or broadcasting
• validate request IDs, signer monotonicity, membership, thresholds, and signed responses
• reject nil, non-positive, wrong-state, and inconsistent-member-order source outputs before SDK builders can panic
• redact Safe views from every CLI JSON response
• move legacy cancel confirmation before the sign-request side effect
• avoid SDK single-response helpers that can panic on empty API arrays
• reject invalid broadcast responses

Verification rerun:

• go test -count=1 ./...
• go test -race -vet=off -count=1 ./...
• go vet ./cmd/safe ./cmd/transfer
• go build ./...
• transfer and Safe transfer help smoke tests
• git diff --check