feat(sdk)!: add scoped authentication key SDK support

[PastaPastaPasta]

Issue being fixed or feature implemented

Applications and wallets must preserve the scoped key permissions enforced by #4613. This PR is stacked on feat/scoped-contract-auth-keys (#4613) and contains the SDK changes only.

What was done?

• Add native scope ABI fields, marshalling, cleanup, restore, and JNI transport; replace the foundation PR’s unsupported-scope guard with complete scope support.
• Preserve scopes in Kotlin persistence (Room 11→12), Swift wrappers/key refresh, and WASM construction and serialization APIs.
• Freeze the V4 SwiftData relationship component and migrate V4→V5 instead of changing V4’s checksum. Existing wallet/key relationships and Keychain references survive, and scope bytes persist across reopening.
• Add the application integration guide and SDK regression/smoke coverage.

How Has This Been Tested?

• Built the macOS native framework and Swift package locally.
• All 7 SwiftData migration tests passed, including V4→V5 preservation and durable scope storage.
• Verified the complete stacked tree is identical to the original feat(platform)!: add contract-scoped authentication keys #4613 head plus the SwiftData migration fix.
• Original Kotlin/JNI/WASM changes and their tests are preserved from feat(platform)!: add contract-scoped authentication keys #4613; CI will validate the split branches.

Breaking Changes

Native libraries, generated headers, and Swift/Kotlin consumers must update together because public-key FFI layouts gain scope fields. Existing stores migrate with Room 11→12 and SwiftData V4→V5. Merge #4613 first; protocol-14 activation is required to register/use scoped keys.

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have added or updated relevant unit/integration/functional/e2e tests
• I have added "!" to the title and described breaking changes in the corresponding section if my code contains any
• I have made corresponding changes to the documentation if needed

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 0eb6619e-26a6-4a23-ba4e-228f1acfcc5a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

✅ Final review complete — no blockers (commit c519d1b) · triage: critical · Phase 2 only (queue backlog)

[thepastaclaw]

Final validation — Phase 2 only (queue backlog)

The scoped authentication-key SDK support is propagated consistently across the native FFI, JNI/Kotlin transport and persistence, Swift wrappers and SwiftData migration, and WASM APIs. The reviewed changes preserve scoped permissions, validate and bound persisted scope data, maintain ownership and cleanup across FFI boundaries, and retain legacy contract-bound behavior; no actionable in-scope defects were identified.

Review provenance

Source: reviewer 1: gpt-6-astra (agent: phase2-reviewer, role: general); reviewer 2: gpt-6-astra (agent: phase2-reviewer, role: ffi-engineer); reviewer 3: gpt-6-astra (agent: phase2-reviewer, role: rust-quality); reviewer 4: gpt-6-astra (agent: phase2-reviewer, role: security-auditor); final verifier: gpt-6-astra (agent: astra-verifier, role: final-verifier)

• Triage: critical by gpt-6-astra (effort low) — This is a large, cross-language change that modifies authentication key handling, FFI/JNI/WASM serialization, and durable Kotlin/Swift storage migrations, directly affecting cryptographic key permissions and persistence in files such as packages/rs-platform-wallet-ffi/src/identity_persistence.rs and DashModelContainer.swift.
• Phase 1 reviewers: not run (skipped for throughput: 14 PRs queued, above the 10 limit)
• Fresh verifier: gpt-6-astra — final-verifier; agent astra-verifier
• Phase 2 reviewers: gpt-6-astra — general (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — ffi-engineer (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — rust-quality (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — security-auditor (completed, effort xhigh); agent phase2-reviewer