Extract the autofill credential resolver and cover its gating

[bradleymackey]

Problem

VaultCredentialProviderViewController (the autofill extension's entry point) had zero tests. Its most security-relevant decision — provideCredentialWithoutUserInteraction deciding whether an item can be served to the QuickType bar without any user interaction — lived inline in the UIKit view controller, untestable: the auth gate via requiresAuthenticationToCopy, the HOTP refusal (counter must not increment without UI), and an untestable direct Date() for TOTP rendering. VaultAutofillViewModel was also untested.

Fix / refactor

• New AutofillOTPCredentialResolver: the body of provideOTPCredential moved verbatim into a small @MainActor struct with an Outcome enum (code / userInteractionRequired / notFound / failure), injected with a retrieval closure, the copy-action handler, and an EpochClock (replacing the raw Date()).
• The VC becomes a thin Outcome → extensionContext switch. The refusal paths map to exactly the same indistinct ASExtensionErrors as before — no new error taxonomy leaking item properties.
• Behavior change: none intended; TOTP rendering now uses VaultRoot.clock instead of Date() (same wall clock in production).

Tests

AutofillOTPCredentialResolverTests:

• nil / malformed / unknown record identifiers and non-OTP items → .notFound
• auth-gated item → .userInteractionRequired (the C4-relevant gate, now pinned)
• HOTP item → .userInteractionRequired
• TOTP item → code rendered for the injected clock's epoch (deterministic, compared against TOTPAuthCode.renderCode directly)
• retrieval error → .failure

VaultAutofillViewModelTests: feature routing, dismiss publisher, blank-string filtering on textToInsertPublisher, cancel-reason forwarding.

VaultiOSAutofillTests goes from 2 tests to 15.

Also fixed en route: the VaultiOSAutofillTests scheme had no TestPlanReference (unlike the other test schemes), so running it standalone ignored TestPlans/Individual/VaultiOSAutofillTests.xctestplan and the snapshot locale guard fataled on non-en_US hosts. The scheme now references its plan, matching VaultiOSTests.

Local verification: VaultiOSAutofillTests scheme green on iPhone 18 Pro Max / iOS 27.0.

⚠️ Automatic CI is still disabled (#548), so this is local verification only.

🤖 Generated with Claude Code