Add account-bound BRC-116 token repository

[rohenaz]

Summary

• add a narrow account-bound PermissionTokenWallet read/crypto seam without claiming full WalletInterface conformance
• add an actor-based BRC-116 repository that always queries canonical spendable admin-basket state, paginates beyond the default page, and validates every candidate against its source BEEF before decoding
• enforce exact DPACP/DBAP scope, DCAP requested-field subset semantics, and greatest-single-token DSAP selection
• permanently invalidate repositories across in-flight awaits and retain verified source identity for later renew/revoke work

Security properties

• list tags and optional locking-script metadata are never authorization evidence
• missing or inconsistent BEEF is a typed integrity error, not a missing grant
• malformed/decryption-failing/non-1-sat/non-spendable candidates cannot authorize
• the repository derives its immutable account ID from the wallet seam, preventing split account/backend binding
• canonical matches cannot be fabricated by downstream callers (PermissionTokenMatch construction is package-scoped)
• storage-reported totals and cumulative scanning are bounded to 10,000 candidates, preventing hostile pagination exhaustion
• no positive permission result is cached

Verification

• swift test --filter PermissionTokenRepositoryTests (12 tests, 0 failures)
• swift test (243 tests, 10 expected live-test skips, 0 failures)