Feat/ts v4.15.0

[gummy789j]

feat(ts): add the SunSwap and SunPump command groups
Seventeen commands: eleven under sunswap — price, token-list, token-search,
pool-list, pool-search, position-list, position-info, swap, add-liquidity,
remove-liquidity, collect-fees — and six under sunpump — buy, sell, launch,
token-list, token-info, token-search. Liquidity covers V2, V3 mint and
increase, and V4 mint and increase; withdrawal and fee collection cover V2,
V3 and V4 as each supports them.

Everything that decides an amount was measured against a live chain rather
than reasoned about, and the measurements are in the code beside what they
justify. Four of them changed the implementation:

A V4 deposit is bounded from ABOVE where every withdrawal is bounded from
below, which means the same approximation is conservative on one protocol and
fatal on the other. Sizing from the tick's own price rather than the pool's
cost a reverted mint — the contract wanted 172953 where we offered 170007 —
and the same imprecision sat harmlessly in V3 only because V3 bounds the
other way.

A V4 withdrawal settles accrued fees alongside the principal, so the receipt
splits them. The spec says the opposite; on the transaction that proved it,
95% of what arrived was fees, and reporting only the principal would have
sent the caller looking for money already in their account.

A native V4 deposit carrying a Permit2 grant was sent with no TRX value,
because the multicall computes none of its own and every native deposit
carries a grant. The earlier live tests happened to use a token-only pool,
which is exactly the branch where it could not bite.

The create endpoint reports time in plain seconds, not the unit the spec
names. Rescaling dated a token made that minute to the year 58709, while the
query path read the same token back correctly — one field, two paths, both
answering success.

The market and curve services answer an unknown parameter by IGNORING it: a
misspelled search returns the whole catalogue with HTTP 200, and an unknown
sort field returns a plausible list in some other order while echoing the
field name back. So every parameter name and sort field is a verified
whitelist, and a value nobody measured is refused rather than forwarded.

Permit2 grants are bounded to the trade and the hour, never unlimited, and
are checked against what they were meant to authorize before a signature
exists and by recovery afterwards. The Universal Router's calldata is decoded
and checked against the same figures, because the floor, the recipient and
the deadline live in the ABI words and nowhere a caller can read.

Amounts are decimal strings and bigint throughout, every published amount
carries its scale, and a figure that could not be read publishes nothing
rather than a zero — on these commands a zero is a claim.