feat: add recipient_allowlist declarative policy rule

[br-to]

What

Add RecipientAllowlist variant to the PolicyRule serde enum — a declarative rule that restricts transaction recipients to an address allowlist (case-insensitive). Denies transactions with no to field (e.g. contract creation).

Why

Recipient allowlists were previously only possible via custom executable policies. Adding a built-in declarative rule lets agents be scoped to specific destination addresses without subprocess overhead.

Testing

• cargo test --workspace passes (265 tests)
• cargo clippy --workspace -- -D warnings is clean
• npm test passes (if Node bindings changed) — N/A, no binding changes
• Tested manually with ows CLI

Notes

• New tests: address match, non-match, case-insensitive, no to field, empty list, serde roundtrip
• Docs updated: added recipient_allowlist section to docs/03-policy-engine.md, removed recipient allowlists from the "not implemented" note

[vercel]

@br-to is attempting to deploy a commit to the MoonPay Team on Vercel.

A member of the Team first needs to authorize it.