feat!: bind fee payment method and cancellable into account entrypoint authwit

[vezenovm]

Problem

Fixes F-841

AccountActions::entrypoint authorized only app_payload.hash(). The later fee_payment_method and cancellable inputs were unsigned, so a party holding an account's authorization witness (a relayer or delegated prover) could reuse it while switching fee_payment_method from EXTERNAL to PREEXISTING_FEE_JUICE (making the account pay from its own fee-juice balance) or flipping cancellable, driving side effects the account never approved.

Fix

The entrypoint now authorizes a combined hash over app_payload.hash(), fee_payment_method, and cancellable under a new aztec-nr-owned domain separator (DOM_SEP__ENTRYPOINT_PAYLOAD), mirrored in the TypeScript builder (computeEntrypointPayloadHash). compute_authwit_message_hash is unchanged, so the pinned AuthRegistry is unaffected and no standard-contract re-pin is needed. All in-repo account contracts delegate to AccountActions::entrypoint, so they inherit the change on recompile with no per-contract edits.

Scope

fee_payment_method and cancellable are deterministic at witness-build time, so binding them does not affect the self-paid deploy flow. Binding the full gas settings is deliberately deferred to a follow-up: self-paid deploy builds the account witness before gas settings are resolved during send preparation (and estimation vs send use different gas), so it needs a deploy-flow sequencing change. Self-paid deploy is first-party (the same local PXE builds and proves), which F-841 identifies as not the exposed path.

Tests

• Noir domain_separators_are_valid registers the new separator and checks derivation + whole-namespace collision-freedom.
• New account_entrypoint.test.ts: the payload authwit request hash is stable for identical requests, differs across every fee_payment_method transition, differs when cancellable flips, and a drift guard re-derives the separator from az_dom_sep__entrypoint_payload.
• The existing account-contract e2e suite exercises both self-deploy and ordinary authenticated calls against the rebuilt account artifacts (runs in CI).

Breaking change

The authorized message preimage changes, so client and account bytecode must be upgraded together, and third-party wallets that build the entrypoint witness themselves must include fee_payment_method and cancellable. Documented in the developer migration notes.