feat(core): add the WIP-109 authenticator registration flows

[Dzejkop]

Adds walletkit_core::registration: the WIP-109 bridge client and the requester and approver flows for registering a new authenticator through an existing Admin Authenticator. The wire format and cryptography stay in world_id_core::registration.

Ported from worldcoin/world-id-protocol#1062, with the wording of worldcoin/world-id-protocol#1093. Stacked on #607.

• Protocol pin. world-id-core and world-id-proof come from world-id-protocol rev f159a868 (#1061, stacked on #1104, on a main that already has #1060) until a protocol release ships the registration API. deny.toml allows that git source.
• Send futures. Every public flow future is Send + 'static when built from owned values, so UniFFI can export it. Bridge retries and the indexer lookup in verify build each attempt from owned values. A compile-time test covers publish, poll, verify, receive, authenticate, check, reject_name, reject, user_verification_failed and approve.
• HTTP client. The bridge client uses WalletKit's bundled-roots client, now shared through http_client::builder(). On native it has a 10 s connect timeout and a 30 s request timeout, and it does not follow redirects. Browsers follow redirects, so the client rejects a redirected response.
• Vault format. PlaintextVault is shared as walletkit_plaintext_v1. PlaintextVault::try_from(Vault) rejects every other format before import.
• Blocking key derivation. RegistrationRequester::new and PendingRegistration::authenticate run Argon2id (64 MiB) synchronously. In walletkit-web they must run in a Web Worker.

Follow-ups

• UniFFI and walletkit-web exports, including the Web Worker for the key derivation.
• Wire PlaintextVault into CredentialStore::merge_vault_from_backup and export_vault_for_backup.
• Port the end-to-end test (crates/core/tests/e2e_authenticator_registration.rs). Blocked: world-id-test-utils needs taceo-oprf-types, which does not compile against WalletKit's alloy-sol-macro 1.7.
• Switch back to crates.io once the protocol releases the registration API.

AI disclosure

Written with Claude Opus 5.5 (Claude Code). Prompt summary: port the WIP-109 registration flows and their tests from world-id-protocol#1062/#1093 into walletkit-core on a protocol pin; make every flow future Send; build the bridge client on WalletKit's HTTP client; define WalletKit's vault format; document where the Argon2id derivation must run in a browser; try to port the end-to-end test.

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

_{Comment @coderabbitai help to get the list of available commands.}