fix: isolate RFC-0022 session and AutoSigning capabilities

[replghost]

Summary

• bind persisted AutoSigning capabilities to the wallet identity, authenticated SSO channel, product subtree, and product account; stale, cross-wallet, and cross-product reuse is rejected
• fence disconnect, logout, identity replacement, reset, and concurrent session transitions with a session lifecycle epoch so cached and durable capabilities cannot survive authority changes
• signing hosts grant AutoSigning per local activation: one allocation consent, then same-product VRF signing without per-request prompts
• export the canonical paired-session authority (activate_external_session, activate_stored_session) so product pairing runtimes reuse the authenticated phone session without browser-owned cryptography
• expose clear_product_state / reset_session_state host admin APIs and describe_core_storage_key for host-private storage policy (Rust + wasm; the wasm signing host is behind the wasm-signing-host feature)
• chainHead follow routing is exact-ID only; the legacy product-sdk follow_N alias convention stays out of truapi-server (Browse does not work on truapi-server #317, fix(server): serve product follow aliases and stamp statement expiry #321)

Subsumes the stacked authority-bridge draft #331.

Verification

• cargo test --workspace (623 tests)
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo check -p truapi-server --target wasm32-unknown-unknown
• cargo +nightly fmt --check

[replghost]

Final reviewed head: ba3c914f948e5a3e77621f96804b26e327cbb9e5. All required CI is green, including Rust workspace, codegen, dependency licenses, JS packages, playground/explorer, and security checks. Independent final cross-repository security review found no remaining blocker in the RFC-0022/0023 scope. Auto-merge is enabled and is waiting only for the required host-sdk-team approval. @pgherveou please review when available.