Require a manager-issued `fee-sponsorship-credential` SD-JWT VC on
POST /wallet/transactions/sponsor/. CredentialAuthGuard now resolves the
required vct from @RequiredCredential route metadata (defaulting to
device-attestation-credential, so existing routes are unchanged).
Possession of the credential is the entitlement — the manager only
issues it to users allowed to use sponsored-fee routes.

The sponsor route additionally requires every user transaction in the
group to be sent from the Algorand address bound to the presented
credential's did:key, so fees are only sponsored for the credential
holder's own transactions.

- Replace the credential-gated GET /wallet/sponsor/ with a public
  unauthenticated GET /wallet/manager/address so wallets can learn the
  Sponsor address before building a group; drop SponsorDetailDto and
  getSponsorInfo
- Add unit specs for CredentialAuthGuard (default and metadata-selected
  vct, cross-rejections, issuer/binding failures)
- Add e2e coverage for the full journey: register the custom
  configuration, issue and redeem the VC over OID4VCI, present it, and
  get the group sponsored — plus rejection of absent credentials,
  device-attestation credentials, and groups sent by other wallets

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

feat: oid4vc with did algo