feat: bridges, PMM, flash workflow, token-aggregation, and deployment docs

- CCIP/trustless bridge contracts, GRU tokens, DEX/PMM tests, reserve vault.
- Token-aggregation service routes, planner, chain config, relay env templates.
- Config snapshots and multi-chain deployment markdown updates.
- gitignore services/btc-intake/dist/ (tsc output); do not track dist.

Run forge build && forge test before deploy (large solc graph).

Made-with: Cursor

script/deploy/DeploySingleCWToken.s.sol

@@ -0,0 +1,44 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import "forge-std/Script.sol";
+import {CompliantWrappedToken} from "../../contracts/tokens/CompliantWrappedToken.sol";
+
+/**
+ * @title DeploySingleCWToken
+ * @notice Deploy exactly one CompliantWrappedToken and grant MINTER/BURNER to the bridge.
+ *
+ * Env:
+ *   PRIVATE_KEY (required)
+ *   CW_BRIDGE_ADDRESS (required)
+ *   CW_TOKEN_NAME (required)
+ *   CW_TOKEN_SYMBOL (required)
+ *   CW_TOKEN_DECIMALS (optional, default 6)
+ */
+contract DeploySingleCWToken is Script {
+    function run() external {
+        uint256 pk = vm.envUint("PRIVATE_KEY");
+        address admin = vm.addr(pk);
+        address bridge = vm.envAddress("CW_BRIDGE_ADDRESS");
+        string memory tokenName = vm.envString("CW_TOKEN_NAME");
+        string memory tokenSymbol = vm.envString("CW_TOKEN_SYMBOL");
+        uint8 decimals_ = uint8(vm.envOr("CW_TOKEN_DECIMALS", uint256(6)));
+
+        require(bridge != address(0), "CW_BRIDGE_ADDRESS required");
+        require(bytes(tokenName).length != 0, "CW_TOKEN_NAME required");
+        require(bytes(tokenSymbol).length != 0, "CW_TOKEN_SYMBOL required");
+
+        vm.startBroadcast(pk);
+
+        CompliantWrappedToken token = new CompliantWrappedToken(tokenName, tokenSymbol, decimals_, admin);
+        token.grantRole(token.MINTER_ROLE(), bridge);
+        token.grantRole(token.BURNER_ROLE(), bridge);
+
+        vm.stopBroadcast();
+
+        console.log(tokenSymbol, address(token));
+        console.log("  bridge", bridge);
+        console.log("  bridgeHasMinter", token.hasRole(token.MINTER_ROLE(), bridge));
+        console.log("  bridgeHasBurner", token.hasRole(token.BURNER_ROLE(), bridge));
+    }
+}