feat(flutter): hire flow UI with escrow summary and error recovery (demo signing)

[moises-cisneros]

Refs #91. UI-only demo of the hire flow; the real payment goes through the server relay (#96, #97).

Summary

• Hire sheet shows the price, destination and escrow contract, signs a mock payload with the wallet, and recovers from signing errors with a retry.
• Signing is a demo: it creates no hire and sends no payment. The final state reads "Demo signature only", with no tx hash and no explorer link, so the UI never claims a payment that did not happen (review feedback).
• The escrow address shown can be overridden with --dart-define=PULS3_ESCROW_CONTRACT=<C...>.
• StellarExpert URL helpers are kept for the real flow.

Not in this PR

• createHire, create_job and fund signing, and confirmation (feat(server): escrow relay prepare and submit endpoints for hires #96, feat(server): durable chain submission tracker with server-submitted escrow calls #97). Issue feat(flutter): hire flow with escrow protection, explorer links, and error recovery #91 stays open until then.

Verification

cd puls3_flutter
flutter analyze --fatal-infos  -> No issues found
flutter test                   -> 75 passed

[cloudflare-workers-and-pages]

Deploying puls3 with    Cloudflare Pages

Latest commit:	03575d8
Status:	✅  Deploy successful!
Preview URL:	https://383a60c8.puls3-4lw.pages.dev
Branch Preview URL:	https://fix-flutter-hire-escrow-flow.puls3-4lw.pages.dev

View logs

[TOMOKI977]

Las piezas visuales están bien (badge de escrow, textos de custodia, links al explorer y tests de la vista). Pido cambios porque el flujo comunica algo que todavía no ocurre:

• HireSheet (hire_sheet.dart:44-52) firma el string mock-usdc-payment:… y luego muestra "Payment confirmed" con un link a StellarExpert hacia una transacción que no existe. Nunca llama a createHire ni a confirmPayment, así que la UI confirma un pago sin hire en el servidor ni fondos en el escrow.
• El retry solo vuelve a firmar. No hay manejo para HireLedgerUnavailable, transaction_not_found ni para un pago enviado pero no confirmado.
• La dirección del escrow está hardcodeada en stellar_explorer.dart:5. Debería venir de configuración o del servidor.

Propuesta: o se conecta al flujo real del servidor (createHire, firma de create_job y fund, confirmación), o se deja explícitamente como demo de UI. En ese caso habría que cambiar el título y ocultar el estado "confirmed" y el link al explorer mientras el pago sea mock. Hoy el título "hire flow with escrow protection" promete más de lo que hace.

[TOMOKI977]

Approved as a UI demo. The previous concern is resolved: the sheet no longer claims a payment, has no tx hash or explorer link, and tests assert both are absent. What gets signed (mock-usdc-payment:...) can't decode as XDR, so nothing real can be signed.

Non-blocking follow-ups, ideally before the real relay flow lands:

• Copy. The error state still says "Payment failed" / "Payment could not be completed" (hire_payment_view.dart:145,155), and the summary shows a "Network fee < 0.00001 XLM" for a transaction that doesn't exist. Something like "Signature failed" and dropping the fee row would keep the demo honest.
• Spec. openspec/specs/flutter-hire-escrow-flow/spec.md has a banner saying the explorer requirements are superseded, but the normative MUST text is still there (tx hash, onOpenExplorer, "funds are locked in Escrow", a "Retry" button while the UI says "Try again"), and no requirement describes the actual demo state. The archived verify-report.md also marks the explorer link COMPLIANT citing a test that no longer exists.
• Config. PULS3_ESCROW_CONTRACT isn't validated, so an empty or malformed define renders as the escrow address. A C... / 56-char check with fallback to the default, plus a test, would cover it.
• Unused helpers. stellarExpertTxUrl and stellarExpertContractUrl have no caller in lib/. Fine to keep for the real flow, but a short note pointing to #96/#97 would help.
• Real wallet readiness. _confirm awaits connect() / signTransaction() with no timeout, and the button is disabled while signing, so a hanging adapter would leave the sheet stuck. Raw e.toString() is also shown to the user. Harmless with MockWallet, worth handling when Freighter is wired.
• HirePhase.confirmed now means "demo signed"; renaming it would avoid confusion when the real confirmed state arrives.

[TOMOKI977]

@moises-cisneros merged into main as 6b0e14d (squash). I updated the branch from main first and CI passed again. #91 stays open for the real flow (createHire, create_job/fund signing and confirmation through the relay in #96). The review notes above can go in a follow-up, ideally before the real wallet adapter is wired.