fix(wallet): consume real sdk 0.13.3, show display_name for Bloque Friends

[MakelangelOO]

Why

• BQE-2635's confirm screen was designed to show the recipient's real name, but getAliasDisplayName only read metadata.name, which never gets populated anywhere in the backend — the sender saw their own alias repeated instead of a name, defeating the verification purpose of the screen.
• @bloque/sdk-identity@0.13.3 (published this session) now types display_name, derived server-side from the recipient's KYC profile (identities.profile), and the backend (payment-rails#980, merged) already serves it.
• Separately, that same backend PR intentionally stopped including details/metadata in the GET /api/aliases response (strict allowlist). The SDK's AliasResponse type still declares both as required, so the old metadata.name/metadata.alias fallback would have thrown at runtime (Cannot read properties of undefined) the next time this screen ran — fixed here before it shipped, not found in production.

How it works

getAliasDisplayName now returns display_name when present (trimmed, non-empty), falling back straight to the raw alias string — no more metadata access. Everything else in the Bloque Friends flow (account_urn resolution, transfer) is unchanged; this PR is purely the SDK version bump plus the one display function.

Changes

• package.json — @bloque/sdk, @bloque/sdk-accounts, @bloque/sdk-identity, @bloque/sdk-swap (deps) and the overrides block (accounts/compliance/core/identity/orgs/swap) bumped 0.13.2 → 0.13.3.
• bun.lock — regenerated.
• src/routes/_authed/send/bloque-friends/index.tsx — getAliasDisplayName: drop the metadata.name/metadata.alias reads (field no longer sent by the backend), prefer display_name, fall back to alias.

Dev requirements

None — no new setup required. @bloque/sdk-identity@0.13.3 is already published on npm.

Risk

• Low — single function changed, typecheck clean, no other call site in the repo reads .metadata/.details off an Alias result (checked).
• The SDK type (AliasResponse) still declares details/metadata as required even though the backend stopped sending them — a latent type/runtime mismatch upstream in the SDK package itself, not fixed here (out of scope for this PR, worth its own follow-up in the sdk repo).

Linear: https://linear.app/bloque/issue/BQE-2635/bloque-friends-transfer-siempre-falla-alias-resuelve-a-identity-urn

[linear]

BQE-2635