Move the console's compliance transfer to legal transfer #338

User story / Problem statement

Currently, the console's compliance transfer calls forced_transfer with the compliance account. The token makes forced_transfer manager-only once #319's contracts land, so the console's transfer fails with Unauthorized on the next deploy.

Expected outcome

Operators sign a compliance transfer with compliance and governance together in one call, through legal_transfer.

Acceptance criteria

• Compliance surface signs legal_transfer with compliance and the token admin as two accounts
• Console no longer calls forced_transfer as compliance
• Sign page maps legal_transfer with a reference input
• Transfer shows in activity with its order reference

Technical notes

• app/src/hooks/useComplianceTransactions.ts:43 calls token.forced_transfer
• app/src/pages/sign.ts:247 maps forced_transfer args
• legal_transfer(from, to, amount, reference, operator): compliance role plus admin signature, different accounts; reference 1-128 bytes

Additional context

Follow-up to #262 / #319.