fix: require private Paykit auth scope

[ben-kaufman]

Description

• require Paykit Server watch-only authorization requests to include both the public and private server capabilities
• compare capability sets independently of ordering
• default local E2E Homegate traffic to the Android emulator host alias (10.0.2.2)
• update to Paykit 0.1.0-rc42 and set localTestnetHost to 10.0.2.2 for local E2E builds
• use the same Pubky client configuration for session bootstrap and the Paykit SDK
• keep production network defaults unchanged

Paykit 0.1.0-rc42 is published for Android and iOS. The local test environment fixes are in pubky/locks#11.

Preview

N/A — no user-facing UI changes.

QA Notes

• ./gradlew detekt passed; reported only existing unrelated warnings.
• The rc42 GitHub Packages publication succeeded and the package version is visible through the GitHub Packages API.
• Local compile/test dependency resolution remains blocked by this machine's credentials for unrelated private LDK/VSS packages; authenticated CI provides the full build verification.
• Build an E2E variant without overriding E2E_HOMEGATE_URL and confirm both Homegate and Paykit resolve through 10.0.2.2.

[greptile-apps]

Greptile Summary

The PR strengthens watch-only Paykit authorization and aligns local E2E Pubky connectivity with Android emulator networking.

• Requires both public and private Paykit server capabilities while allowing either capability ordering.
• Reuses one Pubky client configuration for session bootstrap and Paykit SDK operations.
• Routes local E2E Homegate and Pubky traffic through 10.0.2.2.
• Upgrades Paykit Android to 0.1.0-rc42.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/models/PubkyAuthRequest.kt	Requires the public and private watch-only scopes and compares their capability set independently of ordering.
app/src/main/java/to/bitkit/services/PaykitSdkService.kt	Shares Pubky client configuration across bootstrap and SDK construction, applying the emulator host only for local E2E runs.
app/build.gradle.kts	Changes the default local E2E Homegate endpoint from device loopback to the Android emulator host alias.
gradle/libs.versions.toml	Upgrades the Paykit Android dependency to the release containing the new Pubky client configuration APIs.

_{Reviews (2): Last reviewed commit: "chore: update paykit to rc42" | Re-trigger Greptile}

[jvsena42]

Reviewed and validated locally on this branch.

Validation

Check	Result
just lint (detekt)	BUILD SUCCESSFUL — 10 warnings, all in files untouched by this PR (WalletRepo, BackupRepo, TrezorPreviewData, …). Zero new warnings introduced.
just test	BUILD SUCCESSFUL, 0 failures
Targeted --rerun-tasks on PubkyAuthRequestTest, PaykitSdkServiceTest, PubkyRepoTest, PubkyAuthApprovalViewModelTest	all PASSED, including both new tests
E2E=true GEO=false ./gradlew assembleDevDebug	built successfully (dependency resolution works here, so the blocker noted in the description looks machine-local)
Install + launch on an emulator	no crash, no UnsatisfiedLinkError — the rc42 native lib loads and the new FFI entry points resolve

Runtime confirmation the new config actually takes effect (logcat):

I/paykit: pubky::client::core: Configuring testnet builders for host 10.0.2.2

I also confirmed the motivation for the host change is real: bitkit-e2e-tests/ci_run_android.sh reverse-forwards 60001 / 9735 / 30001 but not 6288, so 127.0.0.1:6288 was genuinely unreachable in CI.

Inline comments below — one correctness issue worth fixing before merge (the reorder test), plus some local-E2E ergonomics and nits.

[ovitrif]

Approved.