Device Fingerprint checks have duplicate overloads

Sensitive actions (transfer, add/update beneficiary, password change) use a two-phase step-up: *initiate* issues a short-lived JWT, *confirm* verifies it. The token is pinned to one specific action via an "action fingerprint". At confirm, the fingerprint is recomputed from the incoming request and compared (`StepUpTokenService.java:91-102`).

Correctness depends entirely on initiate and confirm producing **byte-identical** strings.

The problem is that there are multiple device fingerprint check overloads. And each overload will produce different fingerprint strings.

We dodge this issue in Beneficiaries and Users by using a single device fingerprint helper that calls the same overload. However, transfers does not. Also, future maintainers could end up using the wrong overload, resulting in issues.

Start with StepUpTokenService.java:91-102 and trace the fingerprint generation used by initiate and confirm for transfers, beneficiaries, and users. Compare the available device fingerprint overloads and verify that each sensitive action produces the same byte-identical fingerprint in both phases, with transfers no longer using a divergent overload.

Written by the indexing model from the issue text.