feat(kyc-controller): persist and reuse idOS sessionClientPrivateKey

[jiexi]

Explanation

idOS capability auth updating requires the sessionClientPrivateKey used at session creation to be known. This means it must be persisted for the lifetime of the session so that it can be reused later. This PR makes that change

References

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Medium Risk
Persists a session-scoped cryptographic private key in controller state and changes UKYC session lifecycle teardown; mistakes could break authorization wrapping or leave stale keys attached to invalid sessions.

Overview
Adds idosSessionClientPrivateKey to KycController state so the per-session X25519 key used to wrap UKYC/idOS authorizations survives restarts and can be reused for later capability updates.

UKYC session creation now goes through #getOrCreateIdosSessionClientPrivateKey (reuse persisted key or generate once) instead of a fresh random key on every create; #clearUkycSession drops the key together with SumSub session state on reset(), consents-path failures, and related rewind paths. State metadata marks the field persisted and never logged; architecture docs are updated to match.

Tests cover cold-start reuse, stable key across session-create retries, and clearing when flows are reset or consents fail.

^{Reviewed by Cursor Bugbot for commit ba1b354. Bugbot is set up for automated code reviews on this repo. Configure here.}

[jiexi]

prefer this for now https://github.com/consensys-vertical-apps/va-mmcx-kyc-api/pull/47