refactor: extract duplicated helpers into shared modules

[erubboli]

Summary

DRY refactor of duplication identified across components and API routes. No behavior changes intended — every extracted helper is byte-identical (or a strict superset, via default params / optional headers) to the copies it replaces.

Extractions

New shared module	Replaces
src/lib/client-rpc.ts — rpc<T>() browser-side RPC wrapper	12 identical copies across components
src/lib/api-utils.ts — json() + readFormData()	12 local json() helpers; 6 request.formData() try/catch blocks
src/lib/token-utils.ts — toHexField()	3 copies; placed next to its inverse hexToText()
src/components/ui/ModalOverlay.tsx	3 identical overlay shells (IssueTokenModal, IssueNFTModal, TokenManagePanel via maxWidth/maxHeight props)
src/lib/passkey.ts — consumeChallengeFromRequest()	verbatim challenge-cookie parsing in both passkey verify routes

All 4 passkey routes now use the shared json() helper (extended with an optional headers param, backward compatible).

Deliberately left alone

• SyncStatus.tsx raw fetch — tolerates partial RPC failure; the throwing helper would change behavior
• rpc.ts jsonError — different response envelope (error: {message, code})
• IssueTokenButton/IssueNFTButton, ModeToggle — only 2 occurrences; premature abstraction
• Marketplace/PoolActions/ReceiveModal overlay markup — styling/structure genuinely differ

Test plan

• 502/502 vitest tests pass (passkey route tests updated to mock the new consumeChallengeFromRequest export)
• tsc --noEmit clean
• Net −236 lines (170 insertions / 406 deletions across 37 files)