refactor(truapi)!: move product accounts behind account holders

[pgherveou]

This draft holds the account-holder work as thirteen commits on main. Each commit builds and passes the Rust workspace checks on its own and is meant to become its own pull request, landed in order.

1. refactor(truapi): split ProductRuntimeHost into ProductConnection and HostSession (in review as refactor(truapi): split ProductRuntimeHost into ProductConnection and HostSession #1440): connection state (product, adapters, permissions, channels, chain connection) lives in ProductConnection, the product's account operations in ProductAccounts with the product already bound, and login, logout and identity in HostSession. No behavior change.
2. refactor(truapi): building blocks for account holders: RegistryUpdate for ring-VRF registry writes, TestResourceControls, and a narrower product_manifest. An unchanged registry snapshot is no longer rewritten.
3. fix(truapi)!: account fixes ahead of account holders: a paired VRF request never reuses a local AutoSigning grant, a refused local allocation returns Rejected outcomes as RFC 0010 defines, and Bulletin checks the authorization size before submitting.
4. refactor(truapi): SSO session and responder services: SsoRequestService owns the paired session and its outbound channel, and SsoResponderService the phone's handshake, serve loop and duplicate detection. No behavior change.
5. feat(truapi): one ProductConsent for account access: account-access decisions, review-skip rules, Allow once and one prompt at a time live in one place per runtime.
6. refactor(truapi): one HostGrantStore for kept grants: one store for kept grants on both hosts. A product reset bumps only the grant revision, so other products' work continues.
7. refactor(truapi): move wallet code into its account-holder modules: the phone's wallet code moves unchanged into signing_host/wallet_account_holder/, still as impl SigningHost, so the next commit shows its changes as edits. No behavior change.
8. refactor(truapi): WalletAccountHolder owns the active wallet: the wallet's lifecycle, keys and renewal live in WalletAccountHolder, and only its with_keys reads the root entropy, checking the wallet activation each time. VRF and transaction signing check the session again after the review and the chain metadata fetch. A wallet change mid-renewal stops the pass and reports the remaining targets as failed.
9. refactor(truapi)!: one SSO service per paired peer: each paired browser gets its own SsoAccountHolderService, bound to the wallet activation that accepted it. Native wallets open it with openSsoService, which replaces handleSsoRequest, and the iOS app opens one per paired browser.
10. refactor(truapi): RemoteAccountHolder for the paired host: the paired host's account holder turns each wallet call into an SSO request, and the paired session holds grant writes back while it changes.
11. feat(truapi): renew kept Statement Store keys before submitting: a kept key is reused across UTC periods, and every submit signed with it first runs the renewal check against the chain on a signing host.
12. refactor(truapi)!: HostAccounts replaces ProductAuthority: HostAccounts<H> over an AccountHolder confirms requests and keeps grants on both hosts. Bulletin asks for an authorization increase before submitting instead of retrying after a rejection.
13. feat(truapi)!: persist native allowance keys: native allowance keys survive restarts in protected platform storage, and iOS moves secret core values saved before this version into the Keychain.

Design: Host account holder architecture.

Validation per commit: Rust workspace build, fmt, clippy -D warnings, wasm32 checks, rustdoc and tests (locally only the macOS-only managed_scripts_use_their_project_directory_when_selected_explicitly fails). UniFFI bindings regenerate, the JS host tests pass and the iOS app builds for commit 13; the iOS app builds and its SSO tests pass for commit 9. Android checks did not run locally.

Supersedes #1303, #1305 and #1306.

[github-actions]

Bundle size report

Compared with main at fde9aea.

	Raw	Gzip	Brotli
truapi-host	7.98 MiB (+87.8 KiB, +1.1%)	5.69 MiB (+31.7 KiB, +0.5%)	5.41 MiB (+23.7 KiB, +0.4%)
truapi-provider	4.03 MiB	1.27 MiB	960.9 KiB
truapi	6.30 MiB	891.5 KiB	730.0 KiB
Total	18.32 MiB (+87.8 KiB, +0.5%)	7.84 MiB (+31.7 KiB, +0.4%)	7.06 MiB (+23.7 KiB, +0.3%)

WebAssembly modules

	Raw	Gzip	Brotli
truapi-host/wasm/web/truapi_server_bg.wasm	2.87 MiB (+87.2 KiB, +3.1%)	1.00 MiB (+31.5 KiB, +3.2%)	771.7 KiB (+23.6 KiB, +3.2%)
truapi-host/wasm/web/truapi_verifiable_bg.wasm	4.89 MiB	4.64 MiB	4.61 MiB
truapi-provider/truapi_provider_bg.wasm	3.99 MiB	1.26 MiB	953.1 KiB

Changed files (4)

	Raw	Gzip	Brotli
truapi-host/wasm/web/truapi_server_bg.wasm	2.87 MiB (+87.2 KiB, +3.1%)	1.00 MiB (+31.5 KiB, +3.2%)	771.7 KiB (+23.6 KiB, +3.2%)
truapi-host/generated/host-callbacks.js	11.2 KiB (+428 B, +3.9%)	3.6 KiB (+111 B, +3.1%)	3.0 KiB (+107 B, +3.6%)
truapi-host/generated/host-callbacks-adapter.js	7.2 KiB (+122 B, +1.7%)	1.6 KiB (+18 B, +1.1%)	1.4 KiB (+20 B, +1.4%)
truapi-host/generated/worker-callbacks.js	7.4 KiB (+101 B, +1.4%)	1.5 KiB (+18 B, +1.2%)	1.2 KiB (+16 B, +1.3%)

_{Commit: ce2936b}

[github-actions]

CI Status: 24 required jobs green, 21 passed and 3 skipped by path filter.

All job results

job	result
android-bindings	success
bundle-size	success
changes	success
changeset-guard	success
cli-package	success
codegen	success
e2e	skipped
explorer	success
headless-install	success
host-android-bindings	success
host-android-detekt	success
host-wasm	success
ios-bindings	success
ios-swift	success
licenses	success
playground	success
provider-android-bindings	skipped
release-guard	success
rust	success
ts-client	success
ts-debugger	success
ts-host	success
wasm-provider	success
workflow-lint	skipped

Signing credentials: failure as of 2026-10-15, a release may fail

_{Commit ce2936b8 · run log}

[github-actions]

This pull request touches an app, which is not built by default. Add a label for each build you want:

• iOS simulator build, ios-simulator-build: builds the iOS app, runs its tests and attaches a build for the iOS Simulator on a Mac.
• iOS device build, ios-device-build: attaches a signed build that installs on a registered iPhone or iPad.
• Android build, android-device-build: attaches an APK that installs on an Android phone or an emulator.

Each starts as soon as it is added and follows the branch from then on.