feat(cloud): FTW Cloud C3: app session wire, K11 session info, statistics consent

[frahlg]

FTW Cloud C3, Core's part: what the phone needs to read its home from FTW Cloud. Draft. Based on the C2 branch (#1595), so the diff here is C3 alone.

This is the first half of a wire pair. srcfl/ftw-cloud#5 pins go/protocol to this branch at c6301a0b, and srcfl/ftw-app#19 replays the new vectors in Swift.

What changes

The app session's wire, in go/protocol.

• cloudwire/app.go: the prologue ftw.cloud.v1:<home>, the now, watch, suspend and snapshot bodies, the close codes, and ValidHome.
• cloudwire/testdata/cloud-app-vectors.json: one whole session, byte for byte. It has fixed keys on both ends, message 1 with now, message 2 with a snapshot of the signed vectors, and transport messages both ways.
• appwire/initiator.go: the initiator half of Noise IK. It is checked against the same Cacophony vector as the responder. The service's tests and any Go client use it; Core never runs it.
• appwire.HandshakeState.RemoteStatic() names the initiator's key once message 1 has proved it. The service needs this to check the phone against the box's roster before message 2 carries anything.

K11: FTW Cloud in hello_ok.

• While the grant is on, every role gets hello_ok.cloud = {pk, home, boot, sources, loadpoints} over its own Noise session:
  • the box's P-256 key;
  • the home id;
  • the cloud link's boot id;
  • the tables from anonymous ids to driver names and loadpoint ids.
• The phone checks every envelope FTW Cloud forwards with that key, and learns rule U from this session.
• The field is nil when the grant is off or revoking, when there is no key, and in floor mode.

cloud.link is in the caps when the build can run the uplink. Release builds have no service key, so they do not advertise it.

What the grant flow needs. POST /api/cloud/stats {policy} and DELETE /api/cloud/stats record and withdraw an owner's consent to statistics.

• POST uses the grant's gate and is owner only.
• POST answers 409 when the grant is off or revoking.
• A statsId is drawn once.
• The change marks the roster due.
• No stats messages are sent; that is C7.
• GET /api/cloud shows the purposes. A viewer gets 403 on every cloud route.

cloudwire.View fixes. The Swift port found two bugs in the reference.

• Accept reset the view for a new boot, and turned rule N off, before it had decoded the body and checked seq. A signed message that it then dropped could still wipe what the phone held. It now checks everything first.
• An unknown source state ranked as live when it was the second argument of worse. It now ranks as never on either side.
• The doc's case 11 has a test now. Case 15 (alerts) is C4's.

The roster's device key is the same X25519 key the phone uses as its Noise static toward the box. enroll.Authorise(noise.RemoteStatic, …) stores it, and the roster copies it unchanged. FTW Cloud admits phones by that key.

Deviations from docs/protocol-cloud.md (#1589) the doc should absorb

1. The phone names the home in the query, /v1/app?home=<id>. The prologue binds it, so a wrong one fails the handshake.
2. Message 2 is an unsigned snapshot envelope, {envelopes, lastSeenMs, online, more}. It is not a bare array. Envelopes that do not fit in one Noise message follow as frames, and more counts them.
3. A phone's watch {hz} holds until it changes or the session closes, not for 60 s. While any phone looks, the service renews the box's watch every 50 s, inside the box's 60 s.
4. The close codes on /v1/app:
   • 4400: the phone broke the protocol.
   • 4403: any refusal; it says nothing about which check failed.
   • 4408: replaced by a newer session from the same phone.
   • 4409: the roster changed this phone's access; it reconnects at once.
   • 4429: the home is busy, as at the relay.
5. The phone asks again slowly after 4403, from 7.5 s up to 5 min. A service that just restarted refuses until the box reconnects.
6. The name tables reflect the drivers and loadpoints known at hello. One added later has no name on the phone until the next session.
7. Turning statistics on or off sends no push, like a scope change in C2. DELETE drops the statsId at once. C7 must keep it until purged {what: "stats"} arrives.
8. The grant record gains statsPolicy, because stats carries its own policy.
9. Case 12 says "every source stale". The reference shows no sources and no fields, because the old table is dropped and the new one is not held yet.
10. go/protocol generates no role names, so ftw-cloud spells "owner" by hand. A follow-up could generate the registry's roles.

Checks

• go/protocol: go vet ./... && go test ./....
• From go/: go test -race ./internal/cloudlink/, then go test ./internal/api/ ./internal/appproto/ ./internal/appuplink/ ./cmd/ftw/. All pass.
• make protocol-boundary: 135 packages, none from the box.
• make cloudlink-boundary: 208 packages, none from the box but go/protocol.
• A changeset covers the user-visible part. Release, version and chore(release): version packages #1584 are untouched.

End to end

The run used a Core from this branch, a local ftwcloudd from srcfl/ftw-cloud#5, a simulated house and the app from srcfl/ftw-app#19 over the production relay. Numbers and screenshots are in srcfl/ftw-app#19.

• The grant went on over the owner's Noise session through the consent flow.
• hello_ok.cloud named the key, home and boot.
• Revoking a phone closed its cloud stream 3–12 ms after the request.
• Turning FTW Cloud off in the app's About screen got the purge receipt 7 ms later.

🤖 Generated with Claude Code

[frahlg]

Included in #1607 (FTW Cloud C2, C3 and C4 joined), squash-merged to master.