Temporary accounts per session #1175

One deposit account and one refund account per session, using the product accounts core already derives.

• Accounts under the reserved fund.<network suffix> product (like uid./peopl.)
• Index = getcash label zero-padded to 32 bytes: onramp:eph:<source>:<n>, onramp:rf:<source>:<n>, wd:eph:<source>:<n>
• n from a persisted counter per source, never reused; check the account is empty on chain before handing it out
• No product can derive, sign with or top up from fund.* accounts
• Claimed with the existing PaymentTopUpSource::ProductAccount
• Pairing hosts derive the address from the subtree public key

Done when A session carries its deposit and refund accounts, identical after an app restart, on signing and pairing hosts.
Depends on #1137
Refs #1189 · host_logic/product_account.rs (RFC-0022)