feat(cast): KeyAuthorization signing via non-EOA wallets

[mablr]

Depends on foundry-rs/foundry-core#67 and foundry-rs/foundry-browser-wallet#67 foundry-rs/foundry-browser-wallet#75.

Motivation

Close OSS-168

This PR wires the Foundry side of browser/passkey-backed KeyAuthorization signing into cast.

Changes

• Supports normal root signers and --browser/passkey-backed root signers.
• Rename as subcommand as cast key-authorization keeps cast key-auth as the short alias.
• Emits JSON metadata including signature hash, RLP length, signer, authorized key type, signature type, and witness.

CLI example

Sign an authorization with the browser wallet:

cast key-authorization sign \
  0x1111111111111111111111111111111111111111 \
  --chain-id 4217 \
  --key-type secp256k1 \
  --expiry 1782647677 \
  --limit 0x20c0000000000000000000000000000000000000:10000000:1d \
  --scope 0x20c0000000000000000000000000000000000000:transfer \
  --browser \
  --json

Manual browser-wallet signing was also tested against foundry-browser-wallet running locally with npm run dev.

[figtracer]

One remaining pre-merge blocker: foundry-wallets still points at the moving mablr/sign-authorization-keychain branch.

Once foundry-core#67 lands, please switch this to the merged/released dependency, or at least a fixed rev/tag, so builds are reproducible.

[0xKarl98]

cast keychain authorize --limit now parses TOKEN:AMOUNT[:PERIOD] into TokenLimit.period at crates/cast/src/cmd/keychain.rs:515, but the pre-T3 legacy path later converts those limits into LegacyTokenLimit by copying only token and amount at crates/cast/src/cmd/keychain.rs:2695.

This means a user can request a periodic limit, have the command succeed, and silently receive a non-periodic legacy authorization. The legacy branch should reject any limit.period != 0 with a clear error that periodic limits require a T3-
capable AccountKeychain.

Suggested as following :

if let Some(limit) = limits.iter().find(|limit| limit.period != 0) {
    eyre::bail!(
        "legacy AccountKeychain authorization does not support periodic limits; \
         remove the period from --limit {}:{}:{} or use a Tempo T3-capable chain",
        limit.token,
        limit.amount,
        limit.period
    );
}

let legacy_limits: Vec<LegacyTokenLimit> = limits
    .into_iter()
    .map(|l| LegacyTokenLimit { token: l.token, amount: l.amount })
    .collect();

[0xKarl98]

KeyAuthorizationArgs::into_authorization applies --expiry, limits, and scopes before setting is_admin, so combinations like --admin --expiry 1 currently succeed and produce `KeyAuthorization { expiry: Some(1), is_admin: true, ... }

Tempo validation rejects admin authorizations carrying expiry, limits, or allowed call scopes, so cast key-authorization encode/sign can emit an artifact that is guaranteed to fail later.

Should reject these flag combinations upfront .

[mablr]

@0xKarl98 d4bd87b addresses your comments.

pre-T3 fix + out-scoped post-T5 KeyAuthorization fields support.

[grandizzy]

pls check comments

[figtracer]

left two inline comments.

[figtracer]

lgtm

[grandizzy]

lgtm