feat(truapi): derive funding accounts as getcash does

[filvecchiato]

Funding accounts are derived with getcash's scheme under fund.<suffix>: the funding product's deriveEntropy for the getcash label (onramp:eph, onramp:rf, wd:eph), taken as a mini secret. getcash derives under its own product id, so its existing burners are not among these accounts. A test pins the entropy-to-key step against getcash's own libraries. No product under fund.* can derive entropy, locally or through a paired device.

The deposit watch, assignment and conversion share one finalized Asset Hub client, and signing reads its metadata from the per-chain cache.

Paired hosts hold the root entropy source, so they can compute these keys, as they always could for getcash's burners: the host is trusted with funding keys, products are not.

Part of #1175

[github-actions]

Bundle size report

Compared with main at 02c9712.

	Raw	Gzip	Brotli
truapi-host	7.84 MiB (+55.2 KiB, +0.7%)	5.65 MiB (+18.6 KiB, +0.3%)	5.38 MiB (+13.8 KiB, +0.3%)
truapi-provider	4.03 MiB	1.27 MiB	959.8 KiB
truapi	5.75 MiB (+34.8 KiB, +0.6%)	810.2 KiB (+5.2 KiB, +0.7%)	664.1 KiB (+4.2 KiB, +0.6%)
Total	17.62 MiB (+89.9 KiB, +0.5%)	7.71 MiB (+23.8 KiB, +0.3%)	6.96 MiB (+17.9 KiB, +0.3%)

WebAssembly modules

	Raw	Gzip	Brotli
truapi-host/wasm/web/truapi_server_bg.wasm	2.74 MiB (+54.7 KiB, +2.0%)	980.6 KiB (+18.4 KiB, +1.9%)	740.1 KiB (+13.6 KiB, +1.9%)
truapi-host/wasm/web/truapi_verifiable_bg.wasm	4.89 MiB	4.64 MiB	4.61 MiB
truapi-provider/truapi_provider_bg.wasm	3.99 MiB	1.26 MiB	952.1 KiB

Changed files (10)

	Raw	Gzip	Brotli
truapi-host/wasm/web/truapi_server_bg.wasm	2.74 MiB (+54.7 KiB, +2.0%)	980.6 KiB (+18.4 KiB, +1.9%)	740.1 KiB (+13.6 KiB, +1.9%)
truapi/explorer/codegen/types.js	217.4 KiB (+13.0 KiB, +6.3%)	29.7 KiB (+1.9 KiB, +6.7%)	23.9 KiB (+1.5 KiB, +6.7%)
truapi/playground/codegen/truapi-dts.js	284.8 KiB (+12.0 KiB, +4.4%)	49.1 KiB (+2.1 KiB, +4.5%)	39.6 KiB (+1.7 KiB, +4.4%)
truapi/playground/codegen/services.js	97.9 KiB (+3.2 KiB, +3.4%)	14.7 KiB (+430 B, +2.9%)	12.3 KiB (+327 B, +2.7%)
truapi/generated/types.js	62.8 KiB (+2.9 KiB, +4.9%)	7.7 KiB (+431 B, +5.8%)	6.5 KiB (+314 B, +4.9%)
truapi/generated/client.js	68.8 KiB (+2.3 KiB, +3.5%)	10.3 KiB (+337 B, +3.3%)	8.5 KiB (+276 B, +3.3%)
truapi/generated/wire-decode.js	28.2 KiB (+1.1 KiB, +3.9%)	3.0 KiB (+77 B, +2.6%)	2.5 KiB (+60 B, +2.4%)
truapi-host/generated/host-callbacks.js	10.5 KiB (+432 B, +4.2%)	3.4 KiB (+132 B, +4.0%)	2.8 KiB (+116 B, +4.1%)
truapi/generated/wire-table.js	8.8 KiB (+295 B, +3.4%)	1.5 KiB (+26 B, +1.7%)	1.2 KiB (+19 B, +1.5%)
truapi-host/wasm/web/truapi_server.js	57.8 KiB (+3 B)	10.5 KiB (+1 B)	9.1 KiB (+23 B, +0.2%)

_{Commit: 211f2e7}

[github-actions]

CI Status: 24 required jobs green, 21 passed and 3 skipped by path filter.

All job results

job	result
android-bindings	success
bundle-size	success
changes	success
changeset-guard	success
cli-package	success
codegen	success
e2e	skipped
explorer	success
headless-install	success
host-android-bindings	success
host-android-detekt	success
host-wasm	success
ios-bindings	success
ios-swift	success
licenses	success
playground	success
provider-android-bindings	skipped
release-guard	success
rust	success
ts-client	success
ts-debugger	success
ts-host	success
wasm-provider	success
workflow-lint	skipped

Signing credentials: failure as of 2026-10-06, a release may fail

_{Commit 211f2e76 · run log}

[filvecchiato]

Consolidated into #1230, which carries these commits.