Class RewardProgramTransferService

Move a reward program's overfunded excess out of the pool into another ledger account the same customer owns.

The pool ("Rewards") ledger account is provisioned with ADMIN permissions, so the consumer LedgerAccountTransferService rejects it as a source; the move therefore goes through LedgerAccountTransferAdminService. That admin primitive neither caps the amount nor scopes the target to a customer, so this service owns the two reward-domain invariants it can't enforce:

1. The amount never exceeds current headroom (funded − committed), so the pool is never drawn below the outstanding reward liability — you can only move out what the program is overfunded by.
2. The target ledger account belongs to the same customer ("inside the customer"); the admin transfer allows arbitrary cross-customer targets.

All amounts are MOVEUSD. Idempotency is caller-owned and threaded straight through to the transfer primitive.