docs(low): the three nonce views still tell integrators to sign TransferWithAuthorization

[pviti]

Severity: Low. From the 2026-08-25 read-through of the v1.4.0 branch.

#35's fix moved authorize and charge to receiveWithAuthorization (14e4469), and refund already used it. Every call site in the contract is now the receive variant — but the NatSpec on the three published nonce views still names the transfer variant:

• contracts/src/RAIL0.sol:559 — authorizeNonce: "the buyer must use when signing a TransferWithAuthorization for an authorize call"
• contracts/src/RAIL0.sol:565 — chargeNonce, same wording
• contracts/src/RAIL0.sol:571 — refundNonce, same wording

Failure scenario: these three views exist precisely so an integrator can derive the nonce it must sign over — the gateway builds its signing payload from them. Anyone wiring a signer from this documentation signs the TransferWithAuthorization typehash. interfaces/IEIP3009.sol:25-34 spells out why that fails: the two typehashes are distinct, so the token recovers a different signer and reverts. Every authorize/charge/refund from that integration fails at the token, and the contract's own doc is what led them there.

Worth noting no test can catch this — NatSpec has no runtime behaviour, so the text is its own only guard. It is also the surface integrators read first, before the call-site comments that are correct.

Suggested fix: three one-line edits, TransferWithAuthorization → ReceiveWithAuthorization. The natural home is the docs branch that already carried the refundNonce arity correction (99ed4ae), not a new branch.

For the record, the refundNonce one is older than #35: refund used the receive variant on main too, so that line was already wrong before this release. The other two became wrong with 14e4469.