feat(auth): restore grant auth for the Ring deeplink (#130)

[jvsena42]

Closes the hold from #128. Both platform clients bind the FFI's plain start_auth_flow/await_auth_approval again, so Loopky mints pubkyauth://signin_grant?…&cid=loopky.app&cpk=….

Opened as a draft: the change is complete and green, but it cannot be verified on a device right now — see the blocker below.

The gates #130 listed have all landed

Gate	Status
react-native-pubky on pubky 0.10	0.14.0, published 2026-08-31
Ring merges the grant bindings	4f2798a — "feat: use grant auth pubky bindings (#360)"
Ring cuts a release containing it	v1.19 (2026-09-04); lockfile pins 0.14.0

A fourth gate, recorded only in the signIn/signUp KDoc rather than in the issue, has cleared too. The grant flow's POST /auth/grant/session was refused in 2026-08 with 403 Forbidden - Writing to directories other than '/pub/'. Both homeservers route it today:

                              staging    production
POST /auth/grant/session        422         422     <- route exists, payload rejected
POST /auth/grant/signup         422         422
POST /auth/grant/nonexistent    405         405     <- control

(The 403 was never export_grant_session_secret — that does no I/O in pubky 0.10.)

What changed

1. UniffiPubkyClient / IosPubkyClient → the grant variants, passing LOOPKY_CLIENT_ID. Note the file is no longer AndroidPubkyClient.kt as Restore grant auth once a Pubky Ring release ships on pubky 0.10 #130 says — the jvmShared refactor (KMP toolchain audit against current official guidance: AGP 10 removes how shared is built, and Swift export targets the bridge traps by name #273) means this is shared with the CLI/desktop row.
2. PubkyClient.startAuthFlow KDoc rewritten; the signIn/signUp KDoc corrected, since it claimed "both bind to cookie, like startAuthFlow".
3. asSignupUrl → signup_grant. A one-word change: cid/cpk live in the query, so the host rewrite carries them over untouched.
4. The grant_secret alias in SessionPayloadParser is left alone, exactly as Restore grant auth once a Pubky Ring release ships on pubky 0.10 #130 asked.
5. requireSessionSecretShape fixed — not in Restore grant auth once a Pubky Ring release ships on pubky 0.10 #130, and it would have shipped broken. A grant credential is pubky-grant-credential-v1:<hs>:<secret>:<jws>, four parts where the guard demanded two, so every deeplink session would have been refused as bad_input.

signIn/signUp stay on cookie: their blocker is gone, but nobody has driven them down the grant path. Mixing is safe — restore_session sniffs the token kind, so signOut, revalidateSession and put_with_session take either.

Blocker: Ring v1.19 rejects every auth deeplink

Loopky mints the grant URL correctly (confirmed in logcat on both emulators), but Ring v1.19 answers it with [InputRouter] Unknown input format.

Input to Ring v1.19	Result
Real signin_grant, in-app, cold Ring	Unrecognized format
Real signin_grant, in-app, warm Ring	Unrecognized format — not stale-task replay
Real signin cookie URL from the FFI	Unrecognized format — the control

The cookie row is the point: the flow Loopky shipped before this change fails on v1.19 too, so v1.19 breaks sign-in either way and this PR is not the cause. Measured on emulator-5554 (Pixel_Tablet) and emulator-5556 (Pixel_9, both Ring profiles set up).

Ring's own parser is fine (v1.19's inputParser.ts handles signin_grant/signup_grant) and libpubkycore.so loads. The failure is inside Ring's native parseDeepLink — our pubky 0.10.0 FFI parses all four shapes (cookie/grant, encoded/decoded) without complaint.

This needs a Ring fix before it can merge undrafted. Worth filing against pubky-ring.

Verification

./gradlew :shared:jvmTest :cli:test detektAll green; :androidApp:assembleDebug and lintSwift green. Journey 01 recorded as blocked in journeys/RESULTS.md with the measurements above.

Update — verified end to end with Bitkit

Bitkit (a synonymdev/bitkit-android#1224 build) approves this PR's signin_grant where Ring v1.19 can't. On the emulator:

• The session payload parses through the grant_secret alias Restore grant auth once a Pubky Ring release ships on pubky 0.10 #130 said to keep: {capabilities, grant_secret, pubky}.
• The session revalidates and the deck list loads.
• The first write, the self-tag, gets 403 Write to this path is not allowed. That's the identity's per-user allowed_write_paths quota on staging, not the grant: a grant with the same client_id and caps, for another staging account, writes the same path fine.

On the emulator the sign-in also needed #298 (stacked on this one). The relay's name intermittently fails to resolve there, and without the resume the flow dies before anyone can approve.

Ring v1.19 still rejects every auth deep link, so Ring users stay blocked until Ring fixes that. The measurements above still stand.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YCmMyNzH6r4opjw6X1MZrH