U3: Implement local provider authorization and Keychain storage

[blackforestboi]

Implements U3 of the implementation plan.

Depends on U0 and U2. Implement registration-bundle import, pending approvals, nonces, LocalAuthentication consent, capability/project grants, exact-origin validation, Keychain grants, rotation, and revocation.

Requirements: R3-R5, R12-R14. Exit: local self-approval, replay, endpoint expansion, unauthorized projects, and secret leakage fail closed.