web: a project transfer enters the step-up in place (§2.8.4, §6.25)

tsk-9e5cd0b0hmzx open

Gap. A project transfer needs a step-up (docs/api.md §6.25 transfer; §2.8.4 "Step-up before sensitive calls"). The dashboard has a step-up prompt: M.stepUp.run(call, slot, text) in web/js/step-up.js:129, already used by web/js/admin-limits.js:97 and web/js/admin-registration.js:178. The transfer form in Project settings (web/js/project-names.js) still only says so: on forbidden with reason: step_up_required it shows names.refused.step_up (project-names.js:26-27), and the human has to go to another page and come back.

KTW: web/context/views.md 9cf859f1-d5e0-420c-9ea3-d633cea94e33 ("A project's name is changed in Project settings…") says "A step-up the hub asks for is said, not entered: the dashboard has no second-factor prompt yet". Its trigger "the dashboard gets a second-factor prompt (the transfer's step-up)" has fired, so it stays needs-review until this lands; update it in the same PR.

Done when:

The transfer (and any other call in project-names.js that can answer step_up_required) runs through M.stepUp.run, with a slot in the form, and goes through after the code is entered.
A smoke case that fails on today's main: the fake hub answers the first transfer POST with step_up_required; the form shows the prompt, and after the code the transfer request is sent again.
A translatable text for the prompt, in the catalog like limits.step_up.