Feature: Fetch, cache and serve product manifests

[filvecchiato]

Description

Resolve a product's root manifest from dotNS, cache it, and answer trustedProducts grant questions from it. Fills the manifest_grants_scope seam in truapi-server/src/runtime.rs.

Motivation

Nothing in the repo reads a manifest, so every cross-product access is refused whatever a publisher granted.

Requirements

• Parse trustedProducts; all is a superset, unrecognised values are ignored.
• Cache for one day. The TTL is the revocation bound, not a performance knob.
• A grant never overrides a denial the user already gave.
• One answer for every failure, so the call cannot probe which products exist.
• Works without the target product running.

Tasks

• Implementation — rust-core
• Implementation — hosts
  • dotli
  • Desktop
  • iOS
  • Android
  • host-cli