feat(ios): serve top-ups, payments and balance to the core

[filvecchiato]

Part of #1268 and #778. Stacked on #1314.

The iOS host serves the core's top-up, payment and balance platforms from the engines the app already has. No new engine code.

• Shell (TrUAPIHost.swift): TopUpHostBridge, PaymentHostBridge and BalanceHostBridge, plus setTopUp/notifyTopUpStatus, setPayments/notifyPaymentStatus and setBalance/notifyBalance on TrUAPIHostRuntime, following the contacts pattern.
• App (RustPaymentsBridge, installed by TrUAPIHostRuntimeProvider.attach once PaymentsSupport exists):
  • top-up → IncomingPaymentService.accept / subscribeStatus (product account //product//{productId}/{index})
  • payment → the existing sequence: balance check, approval sheet, privacy confirmation unless minPrivacy, initiateExternalPayment, and its status
  • balance → availablePrivate + gainingPrivacy
• Shared with the legacy handler: ProductPayments holds the payment steps both paths call. The legacy JS handlers behave as before.
• No balance prompt in the host: the core owns BalanceAccess. A shortfall is always reported as InsufficientBalance, and the core decides what the product sees.
• Status forwarding: one follower per (product, id) pushes the engine's statuses to the core until the final one. It starts on a successful top-up or payment, or on the core's first ask after a restart. The balance is pushed on every change.
• Purses: only the main purse; any other answers Unknown.

Not built locally: the Swift package type-checks against generated bindings; the app was not compiled. iOS CI is the first app build. No unit tests yet.

[github-actions]

This pull request touches an app, which is not built by default. Add a label for each build you want:

• iOS simulator build, ios-simulator-build: builds the iOS app, runs its tests and attaches a build for the iOS Simulator on a Mac.
• iOS device build, ios-device-build: attaches a signed build that installs on a registered iPhone or iPad.

Each starts as soon as it is added and follows the branch from then on.

[github-actions]

Bundle size report

Compared with main at 63a450d.

	Raw	Gzip	Brotli
truapi-host	7.82 MiB (+9.9 KiB, +0.1%)	5.64 MiB (+3.6 KiB, +0.1%)	5.37 MiB (-137 B)
truapi-provider	4.03 MiB	1.27 MiB	959.8 KiB
truapi	6.02 MiB (+12.4 KiB, +0.2%)	849.7 KiB (+1.7 KiB, +0.2%)	696.2 KiB (+1.2 KiB, +0.2%)
Total	17.86 MiB (+22.3 KiB, +0.1%)	7.74 MiB (+5.3 KiB, +0.1%)	6.99 MiB (+1.1 KiB)

WebAssembly modules

	Raw	Gzip	Brotli
truapi-host/wasm/web/truapi_server_bg.wasm	2.71 MiB (+9.9 KiB, +0.4%)	969.0 KiB (+3.6 KiB, +0.4%)	730.8 KiB (-152 B)
truapi-host/wasm/web/truapi_verifiable_bg.wasm	4.89 MiB	4.64 MiB	4.61 MiB
truapi-provider/truapi_provider_bg.wasm	3.99 MiB	1.26 MiB	952.1 KiB

Changed files (9)

	Raw	Gzip	Brotli
truapi-host/wasm/web/truapi_server_bg.wasm	2.71 MiB (+9.9 KiB, +0.4%)	969.0 KiB (+3.6 KiB, +0.4%)	730.8 KiB (-152 B)
truapi/playground/codegen/truapi-dts.js	286.1 KiB (+4.4 KiB, +1.6%)	49.5 KiB (+747 B, +1.5%)	39.9 KiB (+536 B, +1.3%)
truapi/explorer/codegen/types.js	216.5 KiB (+4.1 KiB, +2.0%)	29.9 KiB (+522 B, +1.7%)	24.0 KiB (+382 B, +1.6%)
truapi/playground/codegen/services.js	99.3 KiB (+1.5 KiB, +1.6%)	15.0 KiB (+204 B, +1.3%)	12.6 KiB (+145 B, +1.1%)
truapi/generated/types.js	62.8 KiB (+987 B, +1.6%)	7.6 KiB (+98 B, +1.3%)	6.5 KiB (+83 B, +1.3%)
truapi/generated/client.js	70.6 KiB (+900 B, +1.3%)	10.6 KiB (+141 B, +1.3%)	8.9 KiB (+134 B, +1.5%)
truapi/generated/wire-decode.js	28.4 KiB (+424 B, +1.5%)	3.0 KiB (+23 B, +0.8%)	2.5 KiB (+18 B, +0.7%)
truapi/generated/wire-table.js	8.9 KiB (+107 B, +1.2%)	1.6 KiB (+11 B, +0.7%)	1.2 KiB (+6 B, +0.5%)
truapi-host/wasm/web/truapi_server.js	58.0 KiB (+3 B)	10.6 KiB (+8 B, +0.1%)	9.1 KiB (+15 B, +0.2%)

_{Commit: dfb0740}

[github-actions]

CI Status: not green, 2 items need attention.

• ts-host: failure
• host-wasm: failure

All job results

job	result
android-bindings	skipped
bundle-size	success
changes	success
changeset-guard	skipped
cli-package	skipped
codegen	success
e2e	skipped
explorer	success
headless-install	success
host-android-bindings	skipped
host-android-detekt	skipped
host-wasm	failure
ios-bindings	success
ios-swift	success
licenses	success
playground	success
provider-android-bindings	skipped
release-guard	success
rust	success
ts-client	success
ts-debugger	success
ts-host	failure
wasm-provider	success
workflow-lint	skipped

Signing credentials: failure as of 2026-10-08, a release may fail

_{Commit dfb07409 · run log}