feat: add Chat v2 product authority operations

[replghost]

Adds the Chat-specific product authority API on top of the generic PolkaVM host integration in #540.\n\nThis keeps Chat cryptographic authority, peer binding, sealing, and opening out of the generic host PR. Browser consumers should vendor artifacts from this branch rather than adding Chat-specific behavior to #540.

[decrypto21]

Check ordering looks right everywhere. One substantive issue.

1. productDeviceChat reuses a permission meant for something much weaker

It gates on IdentityDisclosure (runtime.rs:576) — the same slot get_user_id uses for "show this product your username" (capabilities/account.rs:513). The key is product-scoped only (truapi-platform/src/lib.rs:1399), nothing marks which capability is asking, and truapi-platform/ has no diff here. But this call binds the wallet's Chat identity and grants a standing Seal/Open oracle against any peer key the product names.

• Signing-host (host_core.rs:597, via frame_server.rs:177): only gate, since SigningHost::product_device_chat (signing_host.rs:995) checks only the session. A product with an older get_user_id grant gets Bind/Seal/Open with no prompt — reproduced on this branch (pre-seeded grant → proceeds, prompt count 0; no grant → Rejected).
• Two-device SSO: sso_responder.rs:934 does prompt the first time, but shows "wants to know it's you" for identity binding plus an encryption oracle. Silent after that.

Worth a dedicated PermissionAuthorizationRequest variant with its own review copy, like the neighbouring AccountAccess. If the reuse is deliberate, the doc comment (truapi-platform/src/lib.rs:1029) and prompt copy should say so.

2. Minor

sso_pairing.rs:399 switches success: *success to (*success).clone() on a struct holding identity_chat_private_key. If that was for the new Drop impl, it isn't needed — box-deref-move compiles fine with Drop. Keeping the move avoids a second live copy.