feat(server): gate external navigation on a per-host remote grant

[filvecchiato]

An http(s) navigate_to needs RemotePermission::Remote { domains: [host] } and returns HostNavigateToError::PermissionDenied without it.

• Grants persist per domain pattern; a multi-domain denial persists against that set only, so the narrower per-host question stays askable.
• Matching lives in the core (remote_domain_candidates): exact host, single-level parent wildcard, *; most specific stored decision wins. One normalization rule (normalize_remote_domain, IDNA ASCII) keys both ends of the lookup.
• dotNS, localhost and the handoff schemes (mailto:, tel:, polkadot:, dot:) consume no grant.

No wire change. iOS generateDomainCandidates walks every parent and needs a follow-up.

[Imod7]

In rust/crates/truapi/src/api/system.rs, the navigate_to doc still says only "Request the host to open a URL.", and that text reaches product authors through codegen. It would be good to say there that an external http or https URL now needs a RemotePermission::Remote grant for the target host, and to widen HostNavigateToError::PermissionDenied in rust/crates/truapi/src/v01/system.rs, which says "User denied the navigation prompt" but is now one of three ways to get it. RFC 0002's implicit-trigger table should also gain host_navigate_to, and note that editing the doc comment means rerunning codegen.

[filvecchiato]

Docs from the review body, all in 7be515e9:

• System::navigate_to says an external http/https URL needs a RemotePermission::Remote grant for the target host, and which destinations consume none.
• HostNavigateToError::PermissionDenied now covers all three routes (user said no, stored refusal, no prompt possible); its Display string went with it.
• RFC 0002: host_navigate_to in the implicit-trigger table, one-grant-covers-both in the domain-matching section, open question 3 settled.
• ./scripts/codegen.sh rerun; the generated TS is gitignored so there is nothing to commit. cargo +nightly fmt, clippy --all-targets --all-features -D warnings and cargo test --workspace are clean.