feat: add Paykit server accounts

[ben-kaufman]

Description

This PR builds on #1066 to add Paykit Server watch-only accounts:

• Presents a dedicated watch-only consent step before the normal Pubky authorization screen.
• Requires x-bitkit-claim=watch-only-account-v1 and the exact /pub/paykit/v0/bitkit/server/:rw capability, rejecting missing, unknown, duplicate, or mismatched companion parameters.
• Uses Paykit approveAuthWithCompanionClaim, failing closed if companion delivery or normal authorization fails.
• Allocates monotonic BIP84 accounts, reuses the same incomplete account on retry, and exports the exact versioned 84-byte claim payload.
• Automatically names new accounts from the requesting service; users can rename them later from Settings.
• Persists and backs up account metadata, serializes lifecycle and reconciliation changes, and supports disabling or restoring LDK tracking without deleting wallet state.
• Configures additional-wallet scanning and the rolling 1,000-address lookahead.
• Deterministically derives the receiver Noise key from the wallet's BIP39 seed using domain-separated HKDF-SHA256 with version, network, and receiver-path context; securely caches and verifies it so the wallet seed remains the only backup required.
• Reuses the derived Noise key across authentication and restarts, and publishes only its receiver marker when live session access becomes available.
• Updates to Paykit 0.1.0-rc37, LDK Node 0.7.0-rc.56, and Bitkit Core 0.4.2; Bitkit Core now supplies trusted extended-public-key serialization, so BitcoinJ is no longer required.

The relay claim contains only the versioned account index, address type, and serialized xpub. Local names and tracking state are not disclosed. Ordinary Pubky Auth remains unchanged.

References:

• Base PR: feat: support paykit receiver paths #1066
• Companion iOS PR: feat: add Paykit server accounts bitkit-ios#630
• Server boundary ADR: https://github.com/pubky/paykit-server/blob/master/docs/ADRs/0001-minimal-paykit-server-boundaries.md#creator-setup-and-bitkit-watch-only-account-claim

QA Notes

Manual Tests

• Scanner → exact Paykit Server setup request → approve watch-only sharing → complete normal Pubky authorization: the account becomes active.
• Claimed xpub → externally derive a nonzero receive address → send funds → restart Bitkit: the additional-wallet full scan discovers the funds.
• Spend the externally received funds from Bitkit.
• Settings → Advanced → Server Accounts → disable and re-enable tracking: the same account and balance return without allocating another account.
• Missing, duplicate, unknown, or mismatched companion parameters/capability are rejected; ordinary Pubky Auth remains unchanged.

Automated Checks

• WatchOnlyAccountClaimCodecTest.kt
• WatchOnlyAccountStoreTest.kt
• WatchOnlyAccountRepoTest.kt
• WatchOnlyAccountLifecycleCoordinatorTest.kt
• WatchOnlyAccountRestoreTest.kt
• PubkyAuthApprovalViewModelTest.kt
• PubkyAuthRequestTest.kt
• PubkyRepoTest.kt
• LightningServiceTest.kt
• PaykitSdkServiceTest.kt
• PrivatePaykitRepoTest.kt
• The Android and iOS receiver-key tests share an independently verified derivation vector and cover persistence, reuse, invalid caches, and wrong-seed fail-closed behavior.
• Paykit rc37 Kotlin compilation and 42 focused SDK/private Paykit tests passed.
• ./gradlew testDevDebugUnitTest
• ./gradlew detekt (passes with unrelated existing findings)

[greptile-apps]

Greptile Summary

This PR adds Paykit Server watch-only accounts. The main changes are:

• Companion-claim validation and a dedicated consent flow.
• Persistent account allocation, backup, restore, and lifecycle handling.
• LDK tracking, reconciliation, and address lookahead.
• Deterministic receiver Noise-key derivation and storage.
• Server account controls in Advanced Settings.
• Paykit, LDK Node, and Bitkit Core dependency updates.

Confidence Score: 5/5

No additional blocking issue was found in this follow-up.

• The remaining activation-recovery concern is the same failure already reported.
• No separate failure requiring an independent fix was confirmed.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/ui/screens/profile/PubkyAuthApprovalViewModel.kt	Adds the watch-only consent and companion-claim authorization flow.
app/src/main/java/to/bitkit/repositories/WatchOnlyAccountRepo.kt	Adds account preparation, tracking, activation, cancellation, and restore operations.
app/src/main/java/to/bitkit/data/WatchOnlyAccountStore.kt	Adds persistent account, allocation, backup, and reconciliation state.
app/src/main/java/to/bitkit/services/LightningService.kt	Adds LDK configuration and reconciliation for watch-only accounts.

_{Reviews (3): Last reviewed commit: "fix: derive Paykit Noise key from wallet..." | Re-trigger Greptile}