feat: add securosys signing driver

[MikolajSzargut]

@canton-network/core-signing-securosys

Signing driver for integrating the Canton Wallet Gateway with Securosys TSB.

Features

• createKey creates a TSB SKA key with a hardcoded empty policy.
• getKeys enumerates TSB keys and returns Wallet Gateway-compatible public
  keys.
• signTransaction creates a TSB sign request and returns the TSB request ID as
  the provider txId.
• getTransaction maps TSB request status/result into Wallet Gateway
  transaction status/signature fields.
• getTransactions fetches by provider transaction IDs. Public-key-only
  filtering is supported from this driver's in-memory transaction cache.
• Runtime configuration can be inspected and changed through
  getConfiguration / setConfiguration.

[mjuchli-da]

Thank you for the contribution! The PR looks very solid, and the most fundamental parts were provided:

• Driver
• Allocator extension
• TransactionService extension
• Tests

There are a few CI blockers and a couple of robustness items before merge. In addition, my manual testing has resulted in an error when attempting to sign a transaction.

Blockers

1. CI
   • test-static: Prettier failures under core/signing-securosys/
   • test-unit: branch coverage 75.38% < 80% threshold for @canton-network/core-signing-securosys
2. Rebase / build tooling — package uses tsup + tsup.base; main has moved to tsdown. Please rebase and align with other core/signing-* packages.
3. EXECUTED without signature — mapTsbStatus maps EXECUTED → signed, but signature is only populated when response.result is present. Returning signed-without-signature hard-fails in the gateway. Fall back to pending (or error) until a usable signature exists.

Manual user testing

I've tested the signing driver with the sent credentials.

Allocate a party/wallet ✅
This worked perfectly by using the asynchronous workflow:

1. createKey
2. getTransaction
3. allocate with received signature

Sign a transaction ❌
The creation of a Ping contract failed at the signing step:

"Error from signing driver: TSB API call to /v1/key/attributes failed (500): {\"errorCode\":701,\"reason\":\"res.error.in.hsm\",\"message\":\"HSM error: status: PKCS#11: KEY_FUNCTION_NOT_PERMITTED\"}",

[MikolajSzargut]

I fixed errors on pipeline related with securosys signing driver - prettier env.ts file and add node to tsdown config. Other errors looks like there is some issues with playwright.

[mjuchli-da]

Congrats!, I verified that the current state works.

I'll leave it to @pawelstepien-da to point out to a few minor ones.

[pawelstepien-da]

Looks very good. Leaving 3 minor comments.
Fix for playwright errors you saw in CI is already merged to main.

[pawelstepien-da]

Party hint is used as label here. Key label has to be unique, while party hint is not.
For example on a single Wallet Gateway instance 2 different users connected to 2 different networks could try to create a party with same hint, and the one who does it later gets error from Securesys API:
{\"errorCode\":608,\"reason\":\"res.error.key.already.existing\",\"message\":\"Could not create key. The key name is already in use.\"}"

I see 2 possible approaches:
-Make key labels something unique. This would probably be problematic when using signTransaction with keyIdentifier.id and warrant using only keyIdentifier.publicKey and I see from the code that acquiring key label by publicKey from API is not straightforward.
-Accept it as driver's limitation and document it in README.md. I confirmed with @mjuchli-da that this is also fine.