feat(phase2): close-empty-ATA flow — build/decode/preview/sign/confirm/receipt

- @pyre/solana: buildCloseEmptyAccountsTx (UNSIGNED v0 tx; re-validates each
  account on-chain — owner==wallet, balance==0, correct program, not
  frozen/delegated, Token-2022 EMPTY_CLOSE_ONLY via §7.1; rejects whole build on
  any ineligible account), simulateTransaction, decodeTransaction. Rent
  destination + close authority + fee payer all pinned to the wallet.
- @pyre/api: POST /api/build/close-empty (server re-validates, 400 on ineligible)
  and POST /api/receipt (on-chain verified: meta.err==null, signer==wallet, rent
  from balance delta; lists only closes whose destination==wallet).
- @pyre/web: select empty accounts → build → CLIENT-SIDE decode+match (7 checks:
  feePayer/all-closeAccount/dest==wallet/closed-set==selected==preview) gates
  signing → sign in wallet → send → confirm → on-chain receipt w/ explorer link.

Built by 3 agents, reviewed by 2 audits (security: SOUND — no critical/high;
integration: SHIP). Applied audit fixes: receipt destination check, doc/lint
cleanup. typecheck 8/8, core 85, solana 19, web build green. Live-verified: the
API refuses to build a close tx for a non-empty account (400). buildBurnTx
remains a Phase-3 stub.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/status/status.json

@@ -37,14 +37,15 @@
     {
       "id": 2,
       "name": "Close Empty ATAs",
-      "state": "todo",
+      "state": "in_progress",
       "items": [
-        { "label": "Identify empty token accounts", "done": false },
-        { "label": "Build close-account tx", "done": false },
-        { "label": "Decode tx preview", "done": false },
-        { "label": "Wallet signing", "done": false },
-        { "label": "Confirmation tracking", "done": false },
-        { "label": "Receipt page", "done": false }
+        { "label": "Identify empty token accounts (server re-validated)", "done": true },
+        { "label": "Build close-account tx (unsigned; classic SPL + Token-2022)", "done": true },
+        { "label": "Decode tx + preview match (rent → your wallet)", "done": true },
+        { "label": "Wallet signing (client-side, adapter only)", "done": true },
+        { "label": "Confirmation tracking", "done": true },
+        { "label": "Receipt page (on-chain verified)", "done": true },
+        { "label": "Live signed close verified e2e (needs an empty ATA)", "done": false }
       ]
     },
     {