Fix: relay tx receipts through the server (CSP blocked direct RPC polls)

After a wallet sent a transaction, waitTx polled the public RPC straight
from the browser, which connect-src 'self' blocks (Firefox NetworkError,
reported by Marty on Activate; the activation itself landed on-chain).
New /api/tx/<hash> relays eth_getTransactionReceipt via the server's RPC
pool, so the browser only ever talks to us and the mainnet flip needs no
CSP changes. Assets v=20260905a.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server.js

@@ -173,6 +173,14 @@ const server = http.createServer(async (req, res) => {
       req.on('close', () => feedClients.delete(res));
       return;
     }
+    m = /^\/api\/tx\/(0x[0-9a-fA-F]{64})$/.exec(p);
+    if (m && req.method === 'GET') {
+      // receipt relay so the browser never talks to the RPC directly (CSP stays 'self')
+      try {
+        const r = await chain.rpc('eth_getTransactionReceipt', [m[1]]);
+        return json(res, 200, r ? { found: true, status: r.status, blockNumber: r.blockNumber } : { found: false });
+      } catch (e) { return json(res, 200, { found: false, rpcError: true }); }
+    }
     if (p === '/api/sponsor' && req.method === 'GET') {
       const tok = parseCookies(req)['iap.sponsor'] || '';
       const sponsorId = await resolveSponsorToken(tok);