Fetch all withdrawal assets for token select

[alan-provable]

Closes #10.

What changed

• Added a paginated loader for the Watcher withdrawal token list.
• The loader keeps calling /address/assets with offset and limit until it has collected the API-reported total.
• Kept the withdrawal form on SWR, so loading and caching behavior still follows the existing app pattern.

Why

The withdrawal token select only used the default /address/assets response. When an address had more tokens than the default page size, later tokens never appeared in the select.

Validation

• git diff --check

I also tried npm ci --ignore-scripts --no-audit --no-fund, but this checkout cannot install cleanly as-is in my environment because the package lock is out of sync and my local Node/npm versions are below the repo engine requirement.

[vercel]

@alan-provable is attempting to deploy a commit to the rosen-bridge Team on Vercel.

A member of the Team first needs to authorize it.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
ui-guard	Skipped		Jun 30, 2026 11:36am

[alan-provable]

Quick check note: the failing Vercel statuses I can see are asking a rosen-bridge team member to authorize preview deployments for this fork. The local validation I could run passed (git diff --check). npm ci --ignore-scripts --no-audit --no-fund is blocked before install because the current lockfile is out of sync with apps/guard/package.json and this machine's Node/npm are below the repo engine requirement. Happy to rerun any maintainer-preferred checks once the preview authorization or lockfile baseline is cleared.