chore(tech-debt): phase 5

[tuddman]

file splits, param structs, expect over unwrap

Final cleanup of the audit's deferred tail. Net: +418 / -338 — the insertions are submodule scaffolding (mod headers + docs); the deletions are the same code, just relocated into focused files.

File splits

• aspens/src/commands/trading/gasless.rs (810 LOC) → gasless/{mod.rs (612), evm.rs (107), solana.rs (119)}. The feature-gated build_evm / build_solana branches now live next door to the dispatcher instead of below 200 lines of unrelated helpers. GaslessBuildArgs and the few shared helpers (unix_secs, parse_cross_chain_token_into_32) and constants (EVM_*_DEADLINE_SECS, SOLANA_DEADLINE_SLOT_BUFFER) became pub(super) so the submodules can see them. No external import path changes — commands::trading::gasless::build_gasless_authorization is still the only public entry point.
• aspens/src/commands/trading/send_order.rs (855 LOC) → send_order/{mod.rs (777), display.rs (101)}. The proto Display impls + the inherent CLI-formatting helpers (TransactionHash::format_for_cli, etc.) split out to display.rs since they don't touch any of the signing / RPC logic in mod.rs. Proto include path fixed for the extra directory level.

too_many_arguments allows: 8 → 4

• gasless.rs::build_evm / build_solana (×2 feature-gated each) all take GaslessBuildArgs<'_> now and lost the allow.
• The 4 remaining allows on derive_order_id / send_order_with_wallet / send_order_with_wallets / call_send_order each have a comment explaining why the flat argument list is the right shape (consensus recipe parity, public API surface, protobuf payload mapping).

unwrap → expect (production paths only)

• BlockingExecutor::new: .expect("failed to build tokio multi-thread runtime for BlockingExecutor").
• aspens::solana::{sysvar_rent_id, sysvar_instructions_id, ata_program_id, ed25519_program_id}: each parse now carries a message naming the well-known id; a panic here would mean catastrophic regression in solana-sdk, and the message says so.
• The ~140 remaining .unwrap() calls in the lib were audited and confirmed to be inside #[cfg(test)] blocks or doc-test examples where they're the standard test idiom. Left alone.

All gates green locally:

• cargo test --workspace --all-features
• cargo test -p aspens --no-default-features --features evm,solana
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo deny --workspace check
• RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps --all-features
• cargo fmt --all -- --check