feat(ramps): add autoramp accounts, NeoBankService, and User Storage sync

[georgeweiler]

Summary

• Add AutorampAccount state and lifecycle helpers to RampsController (refresh, push apply, notify), separate from RampsOrder.
• Introduce NeoBankService to call MetaMask Ramp API neo-bank proxy endpoints (GET /api/v2/autoramps/{id}) with bearer auth.
• Add rampsAutoramps User Storage sync (LWW merge, soft deletes, incremental push) gated on Backup & Sync + signed-in.

Test plan

• yarn workspace @metamask/ramps-controller test (or focused: autorampAccount, NeoBankService, autoramp-syncing, RampsController autoramp cases)
• Confirm messenger hosts can delegate RAMPS_CONTROLLER_REQUIRED_SERVICE_ACTIONS + RAMPS_CONTROLLER_AUTORAMP_SYNC_ACTIONS
• Manual: after unlock with B&S on, syncAutorampsWithUserStorage() then refreshAutoramps() updates local status from neo-bank proxy

Made with Cursor

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 176da6a. Configure here.}

[cursor]

Incremental sync breaks LWW

High Severity

updateAutorampInRemoteStorage always rewrites updatedAt to Date.now() before upload, instead of keeping the account’s existing timestamp like the full-sync upload path. A device with older status can therefore win last-write-wins and overwrite a newer remote status in User Storage.

 

^{Reviewed by Cursor Bugbot for commit 176da6a. Configure here.}

[cursor]

No-op apply clobbers metadata

Medium Severity

applyAutorampRemoteStatus always sets lastSeenStatus to the current status and bumps updatedAt, even when the remote status did not change. Repeated refresh/push with the same status erases prior transition history and advances the LWW clock without a real change.

 

^{Reviewed by Cursor Bugbot for commit 176da6a. Configure here.}

[cursor]

Refresh always pushes storage

Medium Severity

#applyAutorampRemoteSnapshot always calls updateAutorampInRemoteStorage after apply, including when status and other syncable fields did not change. Because User Storage omits depositRailsSummary, these writes mostly mint newer lu timestamps and amplify cross-device last-write-wins conflicts.

 

^{Reviewed by Cursor Bugbot for commit 176da6a. Configure here.}