[EPIC] Verify and accept trusted-session invitations locally

[marwannettour]

Context

When a client receives a trusted-session invitation, local trust must still be enforced. The client must decrypt the envelope, verify the issuer signature, validate the issuer as trusted, ensure the invitation targets the local client, check expiration, check replay protection, and apply local acceptance policy.

Objective

Allow a ByteSync client to receive, verify, display, accept, or reject a trusted-session invitation from a trusted client.

Expected capabilities

• Local decryption of the invitation envelope.
• Signature verification with the trusted issuer public key.
• Recipient identity validation.
• Expiration checks.
• Nonce replay protection.
• Manual acceptance UI when no auto-accept grant applies.
• Initial grant models for future auto-accept decisions.

Acceptance criteria

• A client can receive and decrypt an invitation addressed to it.
• Invitations signed by non-trusted clients are rejected.
• Expired invitations are rejected.
• Replayed invitations are rejected.
• Valid invitations can be shown to the user.
• The user can accept or reject the invitation.
• The decision is returned to the initiator.
• Grant models are ready for auto-accept work.

Out of scope

• Effective session join after acceptance.
• Automatic inventory or synchronization startup.
• Full advanced grant-management UI.

Implementation tickets

• 4.1 Implement local trusted-session invitation decryption #331 4.1 Implement local trusted-session invitation decryption
• 4.2 Implement trusted-session invitation signature verification #332 4.2 Implement trusted-session invitation signature verification
• 4.3 Validate the invitation recipient identity #333 4.3 Validate the invitation recipient identity
• 4.4 Add invitation expiration validation #334 4.4 Add invitation expiration validation
• 4.5 Add replay protection with consumed invitation nonces #335 4.5 Add replay protection with consumed invitation nonces
• 4.6 Add UI for received trusted-session invitations #336 4.6 Add UI for received trusted-session invitations
• 4.7 Add initial auto-accept grant models #337 4.7 Add initial auto-accept grant models
• 4.8 Implement the local invitation acceptance policy #338 4.8 Implement the local invitation acceptance policy
• 4.9 Add local verification tests for trusted-session invitations #339 4.9 Add local verification tests for trusted-session invitations