feat(near): name every intent, and flag the ones that hand over authority

[shahan-khatchadourian-anchorage]

Stacked on #459.

The intent type reaches the screen

serde consumes the intent tag to select the variant, so the type is known and was dropped. Without it, transfer and ft_withdraw differ only by the presence of one Token field under an identical title — an instant, irreversible internal transfer reads like a withdraw. A batch had no boundary either, so a second intent's fields ran on from the first's.

   ├─ Intent: 1 of 2: Transfer
   ├─ To: bob.near
   ├─ Amount: 1 wNEAR
   ├─ Intent: 2 of 2: Add Public Key
   ├─ Add Public Key: ed25519:8rVv...
   └─ [warn] account-control: this key gains permanent authority over the
      account's entire intents balance, until it is explicitly removed

A single-intent envelope titles after its type: NEAR Intent: FT Withdraw.

This mirrors action_boundary_field and title_for on the transaction path, with one deliberate difference: the Intent field renders for a lone intent too, where action_boundary_field omits itself because the title covers it. A signed batch nests intents inside per-payload sections, so a section holding one intent has nothing else naming its type — its title comes from the enclosing borsh transaction.

Intents that hand over authority

add_public_key, remove_public_key, set_auth_by_predecessor_id and auth_call each rendered as one unremarkable line while granting authority rather than moving a named amount. Appended to a legitimate swap they read as part of it. Each now carries a warning naming the consequence — the treatment actions.rs already gives the AddKey action, which it breaks out field by field because "their absent forms widen the grant".

Two intents that cannot execute

Both rendered clean, the same way an expired deadline would without the check beside them:

• An empty intents list does nothing but still spends the signer's nonce — a real no-op nonce burn a user can be tricked into signing.
• A transfer to the signer's own account is refused by Transfer::execute_intent with InvalidIntent.

API

try_render_single_intent returns a RenderedEnvelope carrying the title alongside the fields, rather than making the caller re-parse the envelope to derive it.

Payload shape

This changes the emitted payload, so wallet renderers and any downstream snapshots need to expect:

• one extra TextV2 labelled Intent per intent
• a different Title for single-intent envelopes

Updated here: the e2e expected payload, the CLI display fixture, a CLI title assertion, and the two docs pages showing rendered output.

Scope

Purely additive to the field list. P9 — the Network field and network cross-check on the intents path — is deliberately not here, since it needs wallet-side coordination on a different axis; it follows as its own PR.

Testing

203 tests pass with default features, 187 with --no-default-features, clippy clean, full make test green.

🤖 Generated with Claude Code