feat(core-signing-taurus-protect): add Taurus-PROTECT signing provider

[nbonvin]

Route Canton commands through a Taurus-PROTECT Canton gateway
(tg-canton-gatewayd): a submit provider — the gateway prepares, signs
(ECDSA P-256) and submits each CIP-103 command under Taurus governance,
so the wallet never handles a raw signature; it forwards commands and
reconciles status.

New package @canton-network/core-signing-taurus-protect:

• GatewayClient: JSON-RPC transport (connect, listAccounts,
  prepareExecute, getTransactionStatus) with lazy session and one-shot
  reconnect, a monotonic per-command status cache with requestId
  re-seed, a pre-flight 1 MiB body guard, and an always-set commandId
  as the end-to-end idempotency key.
• routingOnlyCommands: on the encoded path the gateway validates the
  full argument tree only to discard it for the PTX, and real
  token-standard arguments fail that validation, so commands are
  reduced to the routing fields (templateId '#'-prefixed, argument
  trees blanked).
• TaurusProtectSigningDriver: SigningDriverInterface over the client;
  the gateway lifecycle rides in metadata.gatewayStatus ('executed'
  maps to 'signed', unknown values to 'failed').

wallet-gateway-remote wiring:

• TransactionService: sign forwards the command once and re-polls
  after; execute reconciles and never posts to the ledger. A command
  is complete only on 'failed', or on 'executed' once the updateId is
  present — the gateway reports 'executed' before the updateId is
  observable. The ledger updateId stands in for the signature, and the
  executed payload/txChanged event is exactly
  {updateId, completionOffset: 0}.
• TaurusProtectWalletAllocator: imports parties provisioned in
  Taurus-PROTECT (no topology transaction, no hash signing), guarding
  ambiguous prefixes; the vault picker lists parties by prefix.
• Wallet sync skips Taurus-PROTECT wallets in the sync-needed check
  and the repair loop: parties are hosted remotely, so absence from
  the local rights snapshot says nothing.
• Registered when TAURUS_PROTECT_GATEWAY_URL and
  TAURUS_PROTECT_GATEWAY_TOKEN are set.

Single-tenant by design: one machine token serves all wallet users.

Signed-off-by: NBO 519181+nbonvin@users.noreply.github.com

[mjuchli-da]

Thank you for the contribution. We are excited to list Taurus as a signing driver.
We have just switched over from yarn to pnpm. Would you mind rebasing the PR again? Afterward, we will do a detailed review.