[agent] Centralize account deposit reads with TanStack Query

[a16i]

Goal

Replace duplicated manual server-read state in the SDK account deposit flow with an SDK-owned TanStack Query layer, starting with deposit constraints and deposit-status polling. Host apps must keep working without installing or configuring their own query provider.

Context

• Current code still duplicates the same getDepositConstraints useState/useEffect/useRef guard in AccountPaymentPage and AccountApplePayPage. Errors only log and can leave the amount page on a permanent skeleton.
• useDepositPoller hand-rolls interval scheduling, stop state, error handling, and callback freshness across six account-flow call sites. The interval can fire while a prior request is still in flight, and the effect intentionally omits onUpdate and shouldStop from its dependencies.
• The regression history shows real cost in this area: draft retry-loop fix and enrollment form reset fix.
• The broader class-manager proposal is not part of this issue. The SDK now has a tagged DepositState and pure, tested enrollment protocol helpers; adding custom observable manager classes now would create another state-management layer without removing wallet-provider and signing side effects. Re-evaluate that only after the server-read layer is declarative.
• @tanstack/react-query may appear transitively in Daimo development installs, but SDK code should declare it directly if it imports it. It should be a runtime dependency owned by the SDK, not a peer dependency that forces consumer setup.

Acceptance Criteria

• Add @tanstack/react-query as a direct SDK runtime dependency and create a stable internal QueryClientProvider within the account-flow provider lifecycle. Existing SDK consumers do not add a provider or configuration.
• Replace both manual deposit-constraint fetch implementations with one shared query hook keyed by the inputs and scoped so cached authenticated data cannot leak across account identities or provider lifecycles. Loading, error, and retry UI are declarative; a failed request no longer leaves a permanent skeleton.
• Replace the interval/ref implementation of useDepositPoller with a query-backed deposit-status hook and migrate every existing account deposit polling call site. Preserve immediate first fetch, the 5 second default, server-provided interval overrides, navigation behavior, and terminal-state handling.
• Polling does not overlap or duplicate in-flight requests, stops on unmount/disable/terminal status, retries transient read failures, and retains the last successful result during a transient failure.
• Query keys, logs, and diagnostics never contain clientSecret or bearer tokens. Cache state is isolated or cleared across session, logout, and authenticated-identity changes.
• Add regression coverage for query deduplication, retry/error recovery, polling interval and stop behavior, and cache isolation.
• Report the standalone consumer bundle delta (minified and gzip, with a reproducible command or fixture) in the PR description so the dependency trade-off is explicit.

Validation Commands

cd packages/sdk && pnpm test

Constraints

• Keep the first PR limited to getDepositConstraints and getDeposit read/polling paths.
• Do not migrate signing or write mutations such as useDraftDeposit, enrollment submissions, or wallet-provider operations.
• Do not introduce DepositFlowManager, WalletFlowManager, Zustand, or XState in this issue.
• Preserve existing public SDK exports and account-flow behavior.