chore(deps): bump demo @zkp2p/cash to 0.5.3

[ADWilkinson]

The onchain demo pins Cash 0.4.10. Update its standalone npm dependency to published @zkp2p/cash@0.5.3 so future demo builds use the current stable SDK.

Compatibility: #70 identifies the 0.5 breaking changes as method-scoped prepareAccessPolicy and the capabilities overload. The demo does not call prepareAccessPolicy and retains the supported synchronous capabilities() call. SDK quote-identity changes are internal to Cash; the demo calls Cash estimate/order/cashout/watch/withdraw APIs. No call-site migration was required by the demo suite.

Validation at 67953a1: fresh standalone npm install, esbuild bundle, DOM-shim boot with a live EUR estimate, solc 0.8.36 compile, and local-EVM byte-exact html()/request() checks passed. The candidate is 2,372,703 bytes across 97 chunks; both view calls use approximately 11M gas and pass the existing limit checks. The example deliberately ignores its generated nested npm lockfile under its packed-artifact policy.

Visual verification

Independent gauntlet-design-review PASS at 67953a1836f30f1192f83aaa15070e7c26643580: fresh desktop/mobile, light/dark, empty/estimate and missing-wallet evidence. Built and opened out/PeerCash.html in real Chrome at 1440×1000 and 390×844; mobile has no horizontal overflow and the console has no errors. Wallet transaction flows were not exercised. UI diff audit: zero findings.

Original implementation evidence at the same head: inspected real Chrome at 1440×1000 and 390×844, populated Revolut/EUR and entered 100 USDC; the candidate displayed 86.05 EUR at 0.8605 EUR/USDC, with readable controls and no horizontal overflow on mobile. Logged-out coverage only; no wallet transaction was submitted. Repository CI run 34509656798 passed the full bun run ci gate. This PR updates source for future builds; it does not deploy or replace the immutable production contract.

[ADWilkinson]

MERGED — squash commit fdfb28fe2dd9b9a47a343ec49e25df52e25f986d is verified on main; reviewed head 67953a1836f30f1192f83aaa15070e7c26643580.

• codex review --base origin/main exited 0 with no actionable findings. Code-taste T11/T13: the demo retains supported Cash call sites; the one-line published dependency pin needs no compatibility adapter or implementation cleanup. PR copy scan is clean.
• Fresh standalone npm install, bundle, DOM boot with live EUR estimate, solc compile, and local-EVM contract tests passed. Output: 2,372,703 bytes / 97 chunks; html() and request() are byte-exact and each uses approximately 11M gas within the test caps. Full repository CI passed at this head.
• Independent gauntlet-design-review: PASS at the exact head. Opened the freshly built out/PeerCash.html in real Chrome, inspected 1440×1000 and 390×844, light/dark themes, empty and populated estimate states, input focus, and the missing-wallet error. Revolut/EUR with 100 USDC rendered 86.05 EUR at 0.8605 EUR/USDC; mobile document width equals viewport width (390px); no browser console errors. The unchanged layout keeps the amount, estimate and wallet action readable without new decorative elements. UI diff audit: zero findings. Captures below are from this review.
• Wallet transaction flows were not exercised; this source-only example dependency update does not deploy the immutable production contract.

Repair passes: 0. No unresolved reviews or newly arrived human requests. Live main is unprotected and the applicable branch-rules list is empty. No release or deployment is part of this PR.

Post-merge cascade complete: source fdfb28fe2dd9b9a47a343ec49e25df52e25f986d verified on default branch main; merge-commit CI passed.

Only examples/onchain-demo/package.json changed. No mapped release environments or release branches apply; deployment skipped. This ships source for future demo builds, without replacing the immutable deployed contract.

Repository update announcement verified by its unique message marker.