Pro backend updates for 0.2.0 backend

[jagerman]

This PR updates libsession-util for compatibility with the changes made in session-foundation/session-pro-backend#2, along with some related refactoring for integrating the changes with Session clients.

Session Pro: finalize the pre-launch wire/proof protocol + redesign the pro_backend API

Overview

This branch finalizes the Session Pro wire protocol and reworks libsession's
pro_backend / session_protocol code to match, ahead of launch. It is developed
in lockstep with the authoritative spec (session-pro-backend/docs/pro-wire-protocol.md)
and the backend implementation — every wire-affecting change here has a matching
backend change, and the pairing is validated end-to-end (see Testing).

Net effect: a smaller, simpler, more consistent API (+2,122 / −3,559), an opaque
request/response boundary so clients never parse the wire, and a signing scheme that no
longer depends on BLAKE2b.

A sibling branch (pro-backend-updates-pfs) carries the same changes on top of PR #90, adapted to the
post-quantum/std::byte primitives; it will be PRed separately.

Wire-protocol changes (coordinated with the backend spec)

These change bytes on the wire and/or in signatures, and land in lockstep with the backend:

• Time is integer seconds, not milliseconds. Every Pro timestamp/duration is UNIX-epoch
  seconds as a signed int64_t. The only exceptions are the two upstream-provider event
  instants (purchased_ts, revoked_ts), emitted as JSON floats to preserve sub-second
  precision (kept internally as sys_ms / double).
• Signatures sign the message directly — no BLAKE2b, no pre-hash (spec §1.1/§2/§3). All five
  Ed25519 signatures (the offline proof + four signed requests) are now Ed25519(key, M) where M
  is built by a single rule: 16-byte domain prefix, raw fixed-width keys/tags (self-delimiting),
  integers as canonical decimal ASCII (std::to_chars), strings verbatim (UTF-8), and one \0
  between adjacent variable-length fields. New src/pro_message.hpp implements this.
• No version on requests; the proof keeps a plaintext version. Request shapes are
  domain-separated by endpoint + domain prefix, so requests carry no version at all. The proof
  (free-floating, offline-verified) keeps a plaintext version that selects its domain prefix
  (v0 → ProProof_v0_____) — it is a verification input, never a signed byte.
• gen_index_hash → revocation_tag. Renamed everywhere (C/C++ structs + protobuf field);
  it is now a stored random 32-byte value, not a computed hash — clients compare it for equality
  only.
• Payments collapse to one opaque payment_id. The per-provider typed ID fields and the
  provider/plan integer enums are gone; the wire carries an opaque payment_id string plus
  string provider_code / plan codes. Item status and account user_status are parsed as
  opaque pass-through strings.
• Revocation list reshaped. Dropped the absurd per-entry entitlement-expiry; added per-entry
  effective_ts (the real gate) and a single list-level retain_for (memory-only aging) plus
  retry_in. Revocation ticket widened to 64-bit.
• Response envelope redesigned (spec §5): status is a closed string enum
  (ok/fail/error), with an open/additive error_code slug and a single diagnostic error
  string (was an int status + errors[]). add_pro_payment is idempotent (re-claim = success);
  already_redeemed is gone.
• Removed the dead SeshProBackend__ personalisation constant and the historical salted
  generation-token hashing.

API changes (libsession surface)

• pro_backend is now free functions returning an opaque ProRequest. Each builder
  (add_payment_request, pro_proof_request, payment_details_request, refund_request,
  revocations_request) takes loose args (keys, provider_code, payment_id, timestamps) and
  returns ProRequest{ endpoint, content_type, data }. Clients relay data verbatim under
  content_type and never parse it — libsession owns the wire encoding. Response parsing is the
  symmetric set of free functions (parse_*).
• The C request API is a thin shim over the C++ one — the C ..._request_build functions own a
  C++ ProRequest via an opaque handle and point endpoint/content_type/data into it
  (zero-copy); freeing deletes it. No duplicated request-building logic, no input structs.
• ResponseBase carries ResponseStatus status (closed Ok/Fail/Error), plus
  std::optional<std::string> error_code / error; explicit operator bool() for success.
• Removed ProProof::hash() and C session_protocol_pro_proof_hash() — the 32-byte signed
  digest no longer exists. ProProof::signed_message() returns the exact bytes signed, if needed.
• New constants/accessors, owned by libsession (single source of truth, so clients stop
  hardcoding): backend base URL, the backend signing PUBKEY (+ PUBKEY_X25519), per-provider
  support/management provider_urls(), and visible_platforms() — the user-visible purchasable
  provider slugs (google_play, app_store; excludes the hidden rangeproof) for building the
  "purchase via …" list. Signing domain prefixes moved into C++ std::string_view constants.
• Renamed *_unix_ts members to *_at where the value is a sys_seconds (raw-integer unix
  timestamps keep _unix_ts); ProRequest gained an explicit content_type.

Notable design decisions

• Clients never touch the wire or sign anything. The request boundary is opaque bytes; proof
  verification is verify_signature() / status(). This means the signing rework above is
  invisible to client code — no client changes required for it.
• Domain separation over versioning-in-hash. A new request shape earns a new endpoint; the
  proof binds its version via the domain prefix it selects. No version byte is signed.
• std::to_chars decimal integers, explicitly not locale-aware formatters, so the signed bytes
  are identical across languages/platforms and need no endian handling.

Testing

• Full unit suite green on the branch.
• Live cross-implementation validation: a companion integration harness round-trips signed
  requests and proofs against a real backend clone (with the matching spec commit) — this catches
  wire/signing drift (field order, integer encoding, framing, domain prefix) that self-consistent
  unit tests cannot. Both the signing rework and the envelope redesign pass end-to-end.
• Big-endian audit: utils/test-bigendian.sh builds and runs the hash/protocol/pro/config
  suites under emulated s390x (local qemu-user-static) to guard against host-byte-order
  assumptions.

Client migration notes

• Swap any direct JSON building/parsing for the pro_backend *_request() / parse_* functions;
  relay ProRequest.data under ProRequest.content_type unmodified.
• Response handling: branch on status (ok/fail/error); map error_code slugs to localized
  strings (the error string is an English diagnostic, not user-facing). Drop any
  already-redeemed special-casing.
• Read backend URL/PUBKEY/provider URLs/purchasable platforms from libsession instead of local
  copies.
• No action needed for the signing change itself — it is entirely inside libsession.