Widget: requestNwcConnection() -- vault authorization layer, reveal mode

The Phase D surface from vault-ux.md, scoped to NWC and honest about its
boundary: an embedded same-origin widget cannot broker (§CV12.3), so the
API reveals, says so in its consent copy, and leans on the wallet-side
budget as the real security boundary.

One public call owns the whole ceremony. If nobody is signed in, the
sign-in flow runs first and the request resumes via the goto("dashboard")
hook exactly once; if the account has a connection bound to the
requesting origin, the user gets the one-tap approval screen the vault
exists for; otherwise a guided import -- Bitcoin Connect's wallet
chooser or a pasted URI. The BC integration lifts Satisfied's
production discipline verbatim: chooser only, lazy chunks (never
downloaded unless the flow opens), no numeric budget in
authorizationUrlOptions (the unit is not interoperable), disconnect and
clear bc:config so no plaintext copy outlives the ceremony.

The worker holds the vault root (never the sudo key -- wiped on
arrival) and gains vaultStatus/List/SaveNwc/FindForOrigin/RevealNwc/
SetBinding/Delete actions; the root rides the encrypted session cache
so restored sessions keep working, with a vaultEnabled marker so a
stale cache says "sign in again" instead of falsely claiming the
account has no vault. Publishing failures are loud -- a connection that
reached no relay is not saved anywhere and says so. The dashboard gains
Wallet connections management with "revoke app access" and "remove
from BitLogin" honestly separated from wallet-side revocation.
VaultSession gains buildDeletionRequest so the NIP-09 courtesy ask is
signed without exposing the signing key.

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01CMr9Yt8SYmZcfgrg3CV2G1

docs/connection-vault.md

@@ -7,8 +7,12 @@
 (`src/vault/`, plus the capsule fields in `src/capsules/` and the migration in
 `src/account/enableVault.ts`), with test vectors pinned in
 `src/vault/vault.test.ts` and protocol round trips in `vault.e2e.test.ts`.
-The application-authorization layer (§12: consent UI, grants, Connected-apps
-management) is **not yet implemented** — it is the widget generation's work.
+The application-authorization layer (§12) is implemented in `@bitlogin/widget`
+in **reveal mode** for NWC: `requestNwcConnection()` with consent and
+one-tap origin-bound approval, Bitcoin Connect as the lazy-loaded wallet
+chooser, and a "Wallet connections" management screen. Brokered mode waits
+for a real execution boundary (§12.3). Personal-tier UI (sudo ceremony) is
+not yet built.
 See §18 for the decisions finalized at implementation time, including the
 **sensitivity-tier model and the sudo key**, which supersede this document
 where they differ. The companion `vault-ux.md` holds the user-experience