[edo-chan]

Adds the missing Rust hosted authorization-lock API: typed add/remove preparation, current-slot lock reads, and decoding the existing role permission. This is stacked on #66, which contains TypeScript and Python support.

The expiry enum makes callers choose duration or absolute expiry. Requests preserve u64 values as decimal strings; reads validate integer widths, activity, ordering, and lock counters. Preparations preserve signature requests and ParticipantSet approval plans and recognize the current wire kinds 10/11.

Native k1 signing handles the hosted lock API's exact EIP-191 prefix at the 88/16-byte instruction offsets. Raw k1 SignV2 behavior is preserved. Real k1/r1 tests reconstruct the canonical message from serialized arguments, account flags and replay fields, verify signatures, and reject changed lock arguments. Lock permission grants remain in the Protocol SDK because the current hosted add-role contract does not accept that permission.

Draft only, as requested. No CI changes, merges, package publication, or deployment. The existing Rust workflow runs formatting, tests, Clippy, and package verification; its configuration is unchanged. These hosted APIs require portal #1170 and the auth-lock program, but do not depend on Rust Protocol SDK publication.

Validation:

• Full Rust workspace tests passed: 429 library tests plus public API tests.
• cargo +1.96.1 clippy --workspace --all-targets --locked -- -D warnings and formatting passed.
• Cargo package verification and an external consumer of the extracted crate passed.
• Independent review identified the k1 prefix, unsupported grant, and r1 fixture issues; all corrected. Final review at cde0173 found no remaining blockers and independently passed 31 focused tests.