refactor(rust)!: isolate wallet account operations

[pgherveou]

experimental do not review yet

WalletAccountHolder owns wallet secrets, approval, derivation and grant issuance. Local and SSO account access share stored decisions and denial precedence; remote signing remains independent of native AutoSigning. Pairing statements and session-key derivation stay inside the wallet.

Validation: workspace tests, Clippy, rustdoc, protocol-only and both WASM configurations.

[github-actions]

Bundle size report

Compared with main at f106839.

	Raw	Gzip	Brotli
truapi-host	7.82 MiB (+22.9 KiB, +0.3%)	5.64 MiB (+8.6 KiB, +0.1%)	5.37 MiB (+6.0 KiB, +0.1%)
truapi-provider	4.03 MiB	1.27 MiB	959.8 KiB
truapi	5.72 MiB	806.6 KiB	661.3 KiB
Total	17.58 MiB (+22.9 KiB, +0.1%)	7.70 MiB (+8.6 KiB, +0.1%)	6.96 MiB (+6.0 KiB, +0.1%)

WebAssembly modules

	Raw	Gzip	Brotli
truapi-host/wasm/web/truapi_server_bg.wasm	2.72 MiB (+22.9 KiB, +0.8%)	973.2 KiB (+8.6 KiB, +0.9%)	734.3 KiB (+6.0 KiB, +0.8%)
truapi-host/wasm/web/truapi_verifiable_bg.wasm	4.89 MiB	4.64 MiB	4.61 MiB
truapi-provider/truapi_provider_bg.wasm	3.99 MiB	1.26 MiB	952.1 KiB

Changed files (2)

	Raw	Gzip	Brotli
truapi-host/wasm/web/truapi_server_bg.wasm	2.72 MiB (+22.9 KiB, +0.8%)	973.2 KiB (+8.6 KiB, +0.9%)	734.3 KiB (+6.0 KiB, +0.8%)
truapi-host/wasm/web/truapi_server.js	58.0 KiB (+3 B)	10.6 KiB	9.1 KiB (-23 B, -0.2%)

_{Commit: e1c1ace}

[github-actions]

CI Status: not green, 1 item needs attention.

• cli-package: cancelled

All job results

job	result
android-bindings	success
bundle-size	success
changes	success
changeset-guard	success
cli-package	cancelled
codegen	success
e2e	skipped
explorer	success
headless-install	success
host-android-bindings	success
host-android-detekt	success
host-wasm	success
ios-bindings	success
ios-swift	success
licenses	success
playground	success
provider-android-bindings	skipped
release-guard	success
rust	success
ts-client	success
ts-debugger	success
ts-host	success
wasm-provider	success
workflow-lint	skipped

Signing credentials: failure as of 2026-10-07, a release may fail

_{Commit e1c1ace0 · run log}