fix(mobile): make account sign-in recovery reliable

[wgqqqqq]

What changed

This PR replaces #3248 and carries the complete local fix set for mobile account sign-in reliability.

• Keep a completed relay sign-in poll replayable for the same (transaction_id, transaction_secret) pair. Pending responses are not cached, and a mismatched secret cannot overwrite the valid authorized response.
• Recover a stale HarmonyOS HUKS alias on a fresh install before retrying device identity creation.
• Recover a stale Android Keystore alias on a fresh install when the secure namespace has no existing records.
• Preserve existing encrypted session data and secure records by rethrowing failures once data already exists.
• Add a regression test covering replay after a mismatched-secret poll.

The relay change follows the useful direction in #3248, but scopes the cache by both transaction id and secret so an invalid poll cannot consume or replace another client’s authorized result.

Validation

• cargo test -p openbitfun-relay-service
• node scripts/check-core-boundaries.mjs
• Android :app:assembleDebug
• HarmonyOS HAP build and connected-device login smoke test; the client reached relay start/poll successfully after the secure-store recovery.