feat(server): put foreign ring-VRF key use to the user

[filvecchiato]

Part of #373. Resolves ask 1: one interim behaviour for the core, matching Android.

• A foreign key_handle on create_account_proof / ring_vrf_sign raises ForeignRingVrfKey, naming caller, owner, and whether the output is a context-scoped proof or an unscoped signature. Declined is Rejected; NotAllowlisted stays for a manifest allowlist.
• Asked at the authority layer, so a paired-phone request is decided on the device holding the key, once. Never persisted: one approval is not a standing grant.
• RFC-0024 § "Using a foreign key" now specifies the prompt and states that it is the weaker gate.

The playground example for this call can no longer assert a fixed outcome — it accepts approved-or-Rejected.