Validate NEAR Intents quote echoes

[piatoss3612]

Summary

• Fail closed when a NEAR Intents 1Click quote response does not echo the requested route, swap type, fixed-side amount, slippage, refund address, or recipient address.
• Cross-check amountIn/amountOut base units against their formatted display amounts before constructing a SwapQuote.
• Add regression coverage for amount mismatch, unsupported swap type echo, slippage echo mismatch, and address echo mismatch.

Why

The swap review UI displays formatted amounts from the provider response, while the executable ZEC deposit path uses base-unit amounts. A malicious or malformed quote response could otherwise make the wallet review one amount and send another. This patch keeps the quote path fail-closed unless the response is internally consistent and matches the request the wallet sent.

This does not add provider signature verification; the current integration treats the 1Click signature as support/dispute evidence rather than a locally verifiable trust boundary.

Validation

• fvm flutter test test/features/swap/near_intents_one_click_swap_adapter_test.dart
• fvm flutter analyze
• git diff --check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2600d95174

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Validate quoteRequest.amount before accepting quotes

This amount check only compares the executable quote field (amountIn/amountOut) to our request, but it never compares response.quoteRequest.amount, even though that is the provider's echoed user request that the quote/signature/deposit address are tied to. If a malformed or tampered quote echoes a different fixed-side quoteRequest.amount while keeping quote.amountIn/quote.amountOut equal to the requested amount, this validation accepts it and the wallet can proceed with a quote whose signed/request metadata does not match what the user asked for; include actual.amount in this same fixed-side amount comparison.

Useful? React with 👍 / 👎.