feat: add asset status-change and transfer endpoints with history events

[feyishola]

closes #1063
closes #1064
closes #1065
closes #1066

PATCH /api/assets/:id/status and POST /api/assets/:id/transfer, both returning the updated asset with relations so the frontend detail cache can be set directly from the mutation response.

• Add persisted AssetHistoryEvent entity + AssetHistoryService (BE-08), written inside the caller transaction so the event and the asset mutation commit together
• Status changes validate against the AssetStatus enum (400 on unknown values) and against the existing transition table; accept the frontend ACTIVE/MAINTENANCE aliases via normalizeStatus()
• Transfer requires at least one of departmentId/assignedToId and 400s when either target does not exist; setting assignedToId flips status to ASSIGNED, clearing it (null) reverts to AVAILABLE
• Both record STATUS_CHANGED / TRANSFERRED events with actor, timestamp and old -> new values
• Serve GET /api/assets/:id/history from the persisted store, replacing the in-memory AssetStatusController stub that shadowed the new route
• Add category/department/location/assignedTo relations to Asset

Summary

Linked issues

Closes #

Checks

• Lint passes for every area touched
• Build passes
• Tests pass
• No secrets, keys, or .env values are committed

Contract changes only — expand if this PR touches contracts/

Run from contracts/:

cargo fmt --all -- --check
cargo clippy --all-targets --all-features -- -D warnings
cargo test --all

• All three pass
• Reviewed against the relevant sections of
  contracts/SECURITY.md

Confirm the sections that apply to this change:

• Authorization — every new or modified state-changing entrypoint calls
  require_auth() on the correct principal, and no entrypoint treats a
  caller-supplied address argument as proof of identity. Negative tests
  exist without mock_all_auths.
• Arithmetic — no unchecked arithmetic on any path handling amounts,
  shares, or percentages; overflow returns a typed error.
• Storage and TTL — correct durability chosen, and persistent entries
  that must outlive the default are extended.
• Pause — new mutating entrypoints respect the pause guard.
• Admin and upgrades — privileged entrypoints are admin-gated and emit
  an event.
• Events — every new state change emits an observable event, and the
  event catalogue is updated.
• Size — WASM size impact considered for new dependencies or large code
  additions.

If this PR knowingly leaves one of these open, say which and why:

[vercel]

@feyishola is attempting to deploy a commit to the naijabuz's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@feyishola Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[yusuftomilola]

Approving. Clean, focused change: adds asset status-change and transfer endpoints with a new asset-history-event entity/service to track history, plus DTOs for transfer and status-update payloads. Smallest and most contained of the open PRs (14 files) and the diff reads consistently with the existing assets module. Note for the record: CI is currently red on this branch (lint/build/test jobs failing) - merging anyway per repo admin decision; recommend a fast-follow to get these green.