feat(sdk-wasm): multi-resource create_delegation

[skgbafa]

Summary

Extend Session::create_delegation and the createDelegation WASM export to accept the same multi-resource abilities shape as prepareSession:
HashMap<Service, HashMap<Path, Vec<Ability>>>. A single UCAN now encodes every (service, path, actions) entry in one signed blob, scoped to a single target space.

What was broken

1. Service was hardcoded to "kv" in the Rust delegation path — delegations for sql, duckdb, hooks, or capabilities services were silently wrong (the resource URI was built with kv in the service segment).
2. Single-entry only — callers that needed to delegate multiple (service, path) pairs had to issue N separate UCANs. This is wrong semantically (the user model is one delegation per recipient) and, in the legacy wallet-signed fallback, forces N wallet prompts. It also broke the manifest use case in the js-sdk, where an app's manifest can declare multiple permission entries in a single delegations[].permissions block.

What's fixed

• create_delegation now takes abilities: HashMap<Service, HashMap<Path, Vec<Ability>>> and walks every (service, path, actions) tuple, accumulating them into one Capabilities object via with_actions. One signed UCAN, many resource URIs in its attenuation.
• The createDelegation WASM export takes abilities: JsValue in the same { service: { path: [action] } } shape the JS side already uses for prepareSession.
• DelegationResult now returns resources: Vec<DelegatedResource> — a sorted list of {service, space, path, actions} describing every capability the UCAN grants. Sort order is lexicographic on (service, path) so tests and JS consumers get deterministic output regardless of HashMap iteration.
• Validation errors surface as typed variants: EmptyAbilities, EmptyPathsForService, EmptyActionsForPath. Previously an empty actions list under a path would silently sign a useless UCAN.

Tests (11 total, all green)

• create_delegation_single_resource_backward_compat — one service/path round-trips cleanly through the new shape
• create_delegation_multi_service_same_path — KV + SQL on the same app path produce one UCAN with two attenuation entries
• create_delegation_multi_service_multi_path — three different services on three different paths in one UCAN, each getting its own entry
• create_delegation_rejects_empty_abilities
• create_delegation_rejects_empty_actions_under_path
• create_delegation_subset_of_parse_recap — end-to-end invariant that every delegated resource is derivable from the session's own parsed recap (the check the JS delegateTo path relies on)

All existing sdk-wasm tests (parse_recap_*, create_session_and_invoke, session_with_additional_spaces) still pass.

Breaking change

The createDelegation WASM export signature changed from

createDelegation(session, delegateDID, spaceId, path, actions, expirationSecs, notBeforeSecs)

to

createDelegation(session, delegateDID, spaceId, abilities, expirationSecs, notBeforeSecs)

The only JS caller is TinyCloudNode.createDelegationWrapper, which is being updated in the matching js-sdk PR (fix/manifest-signin-multi-delegate) that bumps the WASM rev to this commit.

Test plan

• cargo test -p tinycloud-sdk-wasm --lib — 11/11 pass locally
• cargo check --workspace — clean
• CI green
• js-sdk PR bumps the packages/sdk-rs/Cargo.toml rev to this merge SHA and updates createDelegationWrapper to pass the abilities map