Sign auth entries when the signer is passed by public key

[fnando]

What

Passing an account by its public key (G…) where that account must sign — e.g. an Address argument that calls require_auth() — now resolves to the local identity that holds the matching key, exactly like passing the identity alias does. Previously this failed with Missing signing key for account G…, even though the key was present in the keystore.

Fixes #2459.

Why

Every signing path only resolved in one direction: an identity name or secret to an address/secret. When a raw public key was supplied, resolve_signer → get_secret_key recognized it as a public key and concluded no secret was available, so the auth entry went unsigned. Passing the same account by its alias worked, so the two were inconsistent for what is the same account. This adds the reverse lookup so a public key and its alias behave identically when signing.

Implementation: a new Locator::secret_by_public_key scans stored identities and returns the secret whose public key matches (reusing each identity's ledger/secure-store-aware public-key derivation). UnresolvedMuxedAccount::resolve_secret uses it for literal G…/M… addresses, falling back to the existing CannotSign error only when no identity matches. Covered by unit tests and an integration regression test that reproduces the original failure.

Known limitations

N/A

[Copilot]

Pull request overview

Adds reverse identity lookup so public-key contract arguments can locate their stored signing secrets.

Changes:

• Adds public-key-to-secret identity lookup.
• Resolves public-key arguments into auth signers.
• Adds unit and integration regression tests.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
config/locator.rs	Adds reverse identity lookup and tests.
config/address.rs	Resolves literal account addresses to secrets.
contract/arg_parsing.rs	Creates signers from resolved addresses.
integration/auth.rs	Tests signing via a public key.