feat: outbound transfer authorization & whitelist policy

[sadiq1971]

Background

Inbound EVM (eth_sendRawTransaction) and registration are gated by the whitelist (pkg/user/whitelist, check at pkg/ethrpc/service/service.go:216). Outbound transfers to external parties move value out of the system to arbitrary nodes, so they need an explicit authorization decision rather than inheriting behaviour by accident.

Decisions to make (and document)

• Should outbound party-id transfers be whitelist-gated on the sender's EVM address? (Recommendation: yes, for parity with the inbound gate.)
• Is custodial outbound allowed at all, or do we restrict outbound-to-external to non-custodial (user-signed) only?
• Recipient guards: reject the issuer party, the bridge-operator party, and self-transfers.

Scope

• Implement the chosen gate in PrepareExternal (non-custodial) and the custodial handler, reusing whitelist.Manager / IsWhitelisted.
• Centralise the recipient guards in the shared ValidatePartyID path.
• Tests for allowed vs denied (whitelisted/not, custodial on/off, self/issuer/operator).

Acceptance

• Policy is documented in the epic and in code comments.
• Gate enforced in both outbound handlers; unit tests cover allow/deny matrix.

[sadiq1971]

Tracked by epic #321 (USDCx transfer to external parties via party id).