fix(signer): percent-encode query params in buildMessage to match server

Server's CanonicalQueryString uses url.QueryEscape on all keys and values,
but buildMessage was using raw string interpolation. Cursor values (base64)
contain +, =, / which diverge under encoding — causing 401 on all paginated
signed requests (e.g. portfolio holdings page 2+).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

skills/gmgn-swap/SKILL.md

@@ -88,6 +88,9 @@ All swap-related routes used by this skill go through GMGN's leaky-bucket limite
 | `multi-swap` | `POST /v1/trade/multi_swap` | 5 |
 | `order quote` | `GET /v1/trade/quote` | 2 |
 | `order get` | `GET /v1/trade/query_order` | 1 |
+| `order strategy create` | `POST /v1/trade/strategy/create` | 5 |
+| `order strategy cancel` | `POST /v1/trade/strategy/cancel` | 2 |
+| `order strategy list` | `GET /v1/trade/strategy/orders` | 1 |
 | `gas-price` | `GET /v1/trade/gas_price` | 1 |
 
 When a request returns `429`:

src/client/signer.ts

@@ -44,11 +44,12 @@ export function buildMessage(
   const sortedQs = Object.keys(queryParams)
     .sort()
     .flatMap((k) => {
+      const ek = encodeURIComponent(k);
       const v = queryParams[k];
       if (Array.isArray(v)) {
-        return [...v].sort().map((item) => `${k}=${item}`);
+        return [...v].sort().map((item) => `${ek}=${encodeURIComponent(item)}`);
       }
-      return [`${k}=${v}`];
+      return [`${ek}=${encodeURIComponent(String(v))}`];
     })
     .join("&");
   return `${subPath}:${sortedQs}:${body}:${timestamp}`;