feat: add SSO encryption pubkey support (Mobile SSO spec v0.2.2)

[johnthecat]

Multi-device SSO support, chat attachment improvements, and a file-transfer fix

This branch brings the SDKs in line with the latest Polkadot Mobile protocol and fixes a file-download bug.

Multi-device SSO handshake

The pairing handshake now carries an extra key (ssoEncPubKey) from the mobile app. The host stores it and hands it to your onAuthSuccess callback, so it can set up an encrypted SSO session with the app. Older app versions that don't send it keep working — the field is just null.

createAuth({
  // ...
  onAuthSuccess: ({ session, identityChatPrivateKey, ssoEncPubKey }) => {
    // ssoEncPubKey is null when paired with an app older than the new protocol
  },
})

Explicit session key

createSession now takes a sessionKey — the value used to derive a session's address. Existing behavior is unchanged: pass the peer's key as before. New multi-device callers can pass the shared secret instead.

createSession({
  localAccount,
  remoteAccount,
  // ...
  sessionKey: remoteAccount.publicKey, // unchanged behavior
})

Chat attachments and messages

• Image and video attachments can now carry a thumbnail.
• Attachments include the node endpoint, so the receiver can check it against its allowlist before connecting.
• Call-signalling and coinage-payment messages are now read correctly. Previously one of these messages could corrupt the rest of a synced batch.

File transfer fix

File downloads were signing the wrong payload, which the server rejected and reported as "Data not found". Downloads now sign the correct payload and succeed.