feat(tempo): support P256 session vouchers

[deodad]

Summary

Adds direct TIP-1020 session voucher signing and verification for P256/WebCrypto voucher signers.

Motivation

Session voucher clients were signing through EIP-712 signTypedData, which usually produced Ethereum/secp256k1 signatures. TIP-1034 allows vouchers to use any TIP-1020 signature type, so delegated sessions need to sign the voucher digest directly with the authorizedSigner.

Changes

• Hash voucher typed data in src/tempo/session/Voucher.ts and verify direct TIP-1020 envelopes with SignatureEnvelope.verify.
• Add voucherSigner wiring through src/tempo/client/Session.ts, SessionManager.ts, and ChannelOps.ts so P256/WebCrypto signers can be separate from the channel payer.
• Reject keychain signer accounts for vouchers instead of unwrapping inner signatures; direct voucher verification checks authorizedSigner.
• Add WebCrypto P256 voucher, delegated session, and keychain rejection tests plus a patch changeset.

Testing

• pnpm build
• pnpm check:types
• pnpm check
• pnpm test src/tempo/session/Voucher.test.ts src/tempo/client/Session.test.ts - 2 files passed, 35 tests passed
• Live keychain check: v2 keychain inner signature returned innerValidDirectly: false against the raw voucher digest
• pnpm test - failed locally due to RPC warmup timeouts/400s against localhost:7545/* across unrelated suites and missing Playwright browser binary at ~/Library/Caches/ms-playwright/chromium_headless_shell-1217/...; focused voucher/session tests passed before and after formatting.