feat(truapi)!: persist native allowance keys

[pgherveou]

experimental do not review yet

Native hosts keep issued allowance keys across restarts. Keys persist per wallet, product and resource as CoreStorageKey::NativeAllowanceKey records. Hosts classify storage protection and list keys with coreStorageKeys; product reset and clearWalletState delete a product's or a removed wallet's records. iOS keeps them in Keychain slots and Android in committed encrypted preferences; the JS mock host, wasm and CLI implement the listing.

• Breaking: a host that matches exhaustively over CoreStorageKey must handle the new key.
• Tests: one existing test is removed because its behavior inverts (a new session reuses the same wallet's allowance). New tests are in test(truapi): cover the account-holder split #1306.

Validation: Rust workspace build, fmt, clippy, wasm32 check, rustdoc and tests; @parity/truapi-host build, typecheck and tests; Android host compile and unit tests; CI green.

[github-actions]

Bundle size report

Compared with main at 10a36af.

	Raw	Gzip	Brotli
truapi-host	7.95 MiB (+84.8 KiB, +1.1%)	5.68 MiB (+30.8 KiB, +0.5%)	5.40 MiB (+23.2 KiB, +0.4%)
truapi-provider	4.03 MiB	1.27 MiB	960.2 KiB
truapi	6.29 MiB	890.4 KiB	729.2 KiB
Total	18.27 MiB (+84.8 KiB, +0.5%)	7.83 MiB (+30.8 KiB, +0.4%)	7.05 MiB (+23.2 KiB, +0.3%)

WebAssembly modules

	Raw	Gzip	Brotli
truapi-host/wasm/web/truapi_server_bg.wasm	2.84 MiB (+84.2 KiB, +3.0%)	1014.2 KiB (+30.6 KiB, +3.1%)	764.1 KiB (+23.1 KiB, +3.1%)
truapi-host/wasm/web/truapi_verifiable_bg.wasm	4.89 MiB	4.64 MiB	4.61 MiB
truapi-provider/truapi_provider_bg.wasm	3.99 MiB	1.26 MiB	952.4 KiB

Changed files (4)

	Raw	Gzip	Brotli
truapi-host/wasm/web/truapi_server_bg.wasm	2.84 MiB (+84.2 KiB, +3.0%)	1014.2 KiB (+30.6 KiB, +3.1%)	764.1 KiB (+23.1 KiB, +3.1%)
truapi-host/generated/host-callbacks.js	10.8 KiB (+428 B, +4.0%)	3.5 KiB (+113 B, +3.3%)	2.9 KiB (+109 B, +3.8%)
truapi-host/generated/host-callbacks-adapter.js	7.2 KiB (+122 B, +1.7%)	1.6 KiB (+18 B, +1.1%)	1.4 KiB (+20 B, +1.4%)
truapi-host/generated/worker-callbacks.js	7.4 KiB (+101 B, +1.4%)	1.5 KiB (+18 B, +1.2%)	1.2 KiB (+16 B, +1.3%)

_{Commit: a5ed8d6}

[github-actions]

CI Status: 24 required jobs green, 21 passed and 3 skipped by path filter.

All job results

job	result
android-bindings	success
bundle-size	success
changes	success
changeset-guard	success
cli-package	success
codegen	success
e2e	skipped
explorer	success
headless-install	success
host-android-bindings	success
host-android-detekt	success
host-wasm	success
ios-bindings	success
ios-swift	success
licenses	success
playground	success
provider-android-bindings	skipped
release-guard	success
rust	success
ts-client	success
ts-debugger	success
ts-host	success
wasm-provider	success
workflow-lint	skipped

Signing credentials: failure as of 2026-10-13, a release may fail

_{Commit a5ed8d67 · run log}

[github-actions]

This pull request touches an app, which is not built by default. Add a label for each build you want:

• iOS simulator build, ios-simulator-build: builds the iOS app, runs its tests and attaches a build for the iOS Simulator on a Mac.
• iOS device build, ios-device-build: attaches a signed build that installs on a registered iPhone or iPad.
• Android build, android-device-build: attaches an APK that installs on an Android phone or an emulator.

Each starts as soon as it is added and follows the branch from then on.

[pgherveou]

Collapsed into #1302, which carries this work as separate commits. The branch stays as it is, and a backup is in backup/account-holder-*-2026-10-14-collapse.