feat: add Paykit server accounts

[ben-kaufman]

Description

This PR builds on #620 to add Paykit Server watch-only accounts:

• Presents a dedicated watch-only consent step before the normal Pubky authorization screen.
• Requires x-bitkit-claim=watch-only-account-v1 and the exact /pub/paykit/v0/bitkit/server/:rw capability, rejecting missing, unknown, duplicate, or mismatched companion parameters.
• Uses Paykit companion authorization and fails closed if companion delivery or normal authorization fails.
• Allocates monotonic BIP84 accounts, reuses the same incomplete account on retry, and exports the exact versioned 84-byte claim payload.
• Automatically names new accounts from the requesting service; users can rename them later from Settings.
• Persists and backs up account metadata, serializes lifecycle and reconciliation changes, and supports disabling or restoring LDK tracking without deleting wallet state.
• Configures additional-wallet scanning and the rolling 1,000-address lookahead.
• Updates to Paykit 0.1.0-rc36, LDK Node 0.7.0-rc.56, and Bitkit Core 0.4.2; Bitkit Core now supplies trusted extended-public-key serialization, so Base58Swift and its BigInt dependency are no longer required.

The relay claim contains only the versioned account index, address type, and serialized xpub. Local names and tracking state are not disclosed. Ordinary Pubky Auth remains unchanged.

References:

• Base PR: feat: support paykit receiver paths #620
• Companion Android PR: feat: add Paykit server accounts bitkit-android#1084
• Server boundary ADR: https://github.com/pubky/paykit-server/blob/master/docs/ADRs/0001-minimal-paykit-server-boundaries.md#creator-setup-and-bitkit-watch-only-account-claim

QA Notes

Manual Tests

• Scanner → exact Paykit Server setup request → approve watch-only sharing → complete normal Pubky authorization: the account becomes active.
• Claimed xpub → externally derive a nonzero receive address → send funds → restart Bitkit: the additional-wallet full scan discovers the funds.
• Spend the externally received funds from Bitkit.
• Settings → Advanced → Server Accounts → disable and re-enable tracking: the same account and balance return without allocating another account.
• Missing, duplicate, unknown, or mismatched companion parameters/capability are rejected; ordinary Pubky Auth remains unchanged.

Automated Checks

• WatchOnlyAccountServiceTests.swift
• PubkyAuthApprovalSheetTests.swift
• PubkyAuthRequestTests.swift
• Focused Core 0.4.2 rerun: 41 selected account-service and approval tests passed.
• SwiftFormat, translation validation, and git diff --check passed.

[greptile-apps]

Greptile Summary

This PR adds Paykit Server watch-only accounts to Bitkit. The main changes are:

• Strict parsing for the versioned companion claim and required capability.
• Companion authorization with dedicated consent and account lifecycle handling.
• Monotonic BIP84 account allocation, tracking, reconciliation, and full scanning.
• Backup and restore support for account metadata and allocation state.
• Settings screens for naming accounts and toggling tracking.
• Updated Paykit, LDK Node, and Bitkit Core dependencies.

Confidence Score: 5/5

This looks safe to merge.

• The updated failure path keeps the account tracked after the documented post-delivery authorization error.
• No separate blocking failure was confirmed in the updated authorization lifecycle.

Important Files Changed

Filename	Overview
Bitkit/Services/PubkyService.swift	Adds companion-claim authorization and preserves tracking for the documented post-delivery authorization failure.
Bitkit/Services/WatchOnlyAccountService.swift	Implements account allocation, persistence, authorization state, backup restoration, and tracking reconciliation.
Bitkit/Services/LightningService.swift	Connects watch-only accounts to LDK loading, address revelation, wallet scanning, and reconciliation.

_{Reviews (2): Last reviewed commit: "fix: align Paykit auth UI" | Re-trigger Greptile}