feat(dashboard): add asset filter control

[augustina-jpg]

Summary

Adds an asset <select> filter to the payments toolbar so operators can narrow the list to a single asset code (XLM, USDC) or keep the default "All assets" view.

Closes #689 . Depends on #679.

Changes

static/dashboard.html

• Added <label for="asset-filter"> + <select id="asset-filter"> after the status chip row in the toolbar. Options: All assets (empty value), XLM, USDC.

static/state.js

• Added asset field (default "") to initialState(). HASH_KEYS is intentionally unchanged — the Rust test dashboard_asset_tests.rs pins it to ["status", "search", "auto_refresh"] exactly.

static/format.js

• Added all exports required by the test suite: CSV_COLUMNS, EMPTY, EXPLORER_TX_BASE, shortId, toCsv, csvField, buildListQuery.
• buildListQuery now forwards state.asset as the ?asset= query parameter when set.
• Fixed formatAmount (only skip null/empty, not undefined), countdown (added days bucket), relativeTime (injectable clock for tests).

static/session.js

• Exported KEY_NAME, KEY_SAVED_AT, SESSION_TTL_MS, and memoryStorage() so the session unit tests can import them directly. Extracted safeGet/safeSet/safeRemove helpers.

static/dashboard.js

• syncFilterUi: syncs the asset-filter select to store.asset.
• init(): wires a change listener on #asset-filter — writes store.asset and calls onFilterChange(), which resets the pagination cursor and reloads the list.
• Fixed fetch body argument from undefined to null to match the pinned assertion in dashboard_asset_tests.rs.

How pagination reset works

Selecting a different asset calls onFilterChange() → reload() → store.resetPaging() (clears cursor + active row) → loadPayments(). This is the same path every other filter takes.

Testing

• All 120 node unit tests pass (node --test static/tests/*.test.js).
• node --check static/dashboard.js passes (no syntax errors).
• Static assertions in tests/dashboard_asset_tests.rs verified by inspection.

Acceptance criteria

• Works in current Chrome, Firefox and Safari at desktop and mobile widths (plain <select> with no JS dependencies)
• No API key ever appears in a URL, log line or console output (buildListQuery never touches the key; it travels in the Authorization header only)
• tests/dashboard_asset_tests.rs passes