[codex] add signed device identity to connect handshake

[gamerg21]

Summary

Chowder iOS was failing connect against gateways that enforce device authentication because the client did not send a params.device payload. This change adds a persistent Ed25519 device identity, signs the required v2 payload, and sends device proof in the connect request.

User Impact

Before this fix, users hit connection/auth failures even with a valid gateway token because the gateway required signed device identity fields (id, publicKey, signature, signedAt, nonce) that were missing.

Root Cause

The iOS handshake only sent auth.token and omitted the device identity/signature flow. It also had no persisted device keypair or device token lifecycle handling.

Fix Details

• Added DeviceIdentityService to:
  • load/create a persistent Ed25519 keypair in Keychain (Curve25519.Signing.PrivateKey)
  • derive deviceId as lowercase hex sha256(publicKeyRaw)
  • encode public key/signature as base64url without padding
  • sign the exact payload format:
    • v2|<deviceId>|<clientId>|<clientMode>|<role>|<comma_scopes>|<signedAtMs>|<token>|<nonce>
• Extended KeychainService with binary save/load methods for raw private-key bytes.
• Updated ChatService.sendConnectRequest to:
  • prefer persisted hello-ok.auth.deviceToken over raw gateway token on reconnect
  • build and send params.device = { id, publicKey, signature, signedAt, nonce }
  • keep client metadata (openclaw-ios, ui, operator, scopes) aligned with the signed payload.
• Updated hello-ok handling to persist auth.deviceToken for subsequent connects.

Pairing Behavior

After this change, first connect may return NOT_PAIRED until host approval is granted (openclaw devices list then openclaw devices approve --latest). Reconnect after approval.

Validation

• Attempted build check:
  • xcodebuild -project Chowder/Chowder.xcodeproj -scheme Chowder -configuration Debug -sdk iphonesimulator build CODE_SIGNING_ALLOWED=NO
  • Blocked in this environment because full Xcode is not installed (xcode-select points to CommandLineTools only).
• Diff review confirms the handshake now includes signed device params and device token persistence.

[sametguzeldev]

I had the same issue and about to create a PR and saw you already have done it :))
This solution worked for me thanks!