fix(terminal): sign as the RFC-0022 product account

[Imod7]

Closes #168

Description

Product accounts were derived with three soft junctions from the session's root public key, which predates RFC-0022. RFC-0022 made //product//{productId} two hard junctions, and a public key cannot cross those, so the derived address stopped matching the one the hosts use. The subtree key now comes from the paired wallet via getProductSubtree, and the account is soft-derived from it.

Product-account addresses change as a result, so anything funded at a previously derived address, or any allowance granted to one, is worth checking before upgrading. Signing failed closed in the meantime: the wallet resolves an account selector rather than a key, so it signed as the correct account and transactions were rejected rather than misapplied.

Changes

deriveProductAccountPublicKey(productSubtreePublicKey, derivationIndex) replaces the three-argument form, and createChainCode is gone. createSessionSigner, createSessionSignerForAccount and deriveProductPublicKey return promises, since the first derivation per product costs one consent-free round trip to the phone, cached afterwards. The RFC-0022 index expansion moves to @parity/product-sdk-utils, shared with packages/individuality.

Testing

The old fixtures were generated from the implementation they were meant to check, so they froze the wrong answer. The test now derives the subtree from a seed and matches host-rust-core's own vector in truapi-server/tests/wasm_crypto_vectors.rs (0x1c1ae478...21cd5b5c).

cd product-sdk && pnpm install --frozen-lockfile
pnpm build && pnpm typecheck && pnpm check
LC_ALL=en_US.UTF-8 pnpm -r --no-bail test

1985 tests pass across 19 packages, terminal 196 including both interop suites. Not covered: signing against a physically paired phone.

[github-actions]

📦 Bundle size impact

Comparing 2026-09-07T21:02:30.345Z → 2026-09-07T21:02:46.925Z

	Package	Entry	Bundled before	Bundled after	Δ	Ship gzip Δ	Shake ratio
🟢	@parity/product-sdk	./individuality	80.0 KB	80.2 KB	+169 B (+0.2%)	0 B	—
🟢	@parity/product-sdk-keys	.	154.9 KB	156.0 KB	+1.2 KB (+0.7%)	-210 B	68% (was 68%)
🟢	@parity/product-sdk-statement-store	.	110.0 KB	110.2 KB	+204 B (+0.2%)	0 B	9% (was 9%)
🟢	@parity/product-sdk-terminal	.	729.3 KB	696.3 KB	-33.0 KB (-4.5%)	+1.8 KB	38% (was 36%)
🟢	@parity/product-sdk-terminal	./host	64.3 KB	64.5 KB	+193 B (+0.3%)	+1 B	95% (was 96%)
🟢	@parity/product-sdk-utils	.	18.2 KB	18.6 KB	+445 B (+2.4%)	+268 B	47% (was 9%)

Thresholds — 🟡 ≥10% or ≥5.0 KB · 🟠 ≥20% or ≥15.0 KB (bundled). Percentage only applies once the baseline is ≥ 10 KB. Informational — this check never blocks merge.