AlgoScan

recursiveTagFields passed the raw codec tag down when recursing into a
struct field, so a tag like `codec:"txn,required"` produced tag paths of
the form `txn,required.*`. Every ignoreTags lookup for a nested field
then missed, and the generated filter tag would carry the encoder option
in its name.

Parse the tag name once, before recursing, and use it for both the
nested path and the leaf's full tag. A tag that only carries options
(`codec:",omitempty"`) names nothing, so it is now treated as untagged
at any level rather than only at leaves.

No SDK struct-typed field carries tag options today, so the generated
map and tags doc are unchanged.

Co-authored-by: Gabriel Kuettel <gabrielkuettel@gmail.com>

- Define _empty_ so it does not rely on resource counts that the balance
  record field list does not include.
- Introduce the State Proof sender address in the lead-in sentence,
  before its first use in the conditions.
- Fold the trailing note into the first condition: an account holding a
  resource is not exempt, rather than being required to satisfy an
  unsatisfiable requirement.
- Say the three special addresses are exempt unconditionally, so the
  statement does not read as contradicting the empty record exemption.
- List the State Proof sender alongside the incentive pool and the fee
  sink in the Account State section.

Replace the zero-stake exemption in the first account state validity
condition with an exemption for accounts whose balance record is empty,
and exempt the State Proof sender address from both minimum balance
conditions, matching the reference implementation.

fix: skip optional renderer when serving (patches mdbook 0.5.4)

Require a manager-issued `fee-sponsorship-credential` SD-JWT VC on
POST /wallet/transactions/sponsor/. CredentialAuthGuard now resolves the
required vct from @RequiredCredential route metadata (defaulting to
device-attestation-credential, so existing routes are unchanged).
Possession of the credential is the entitlement — the manager only
issues it to users allowed to use sponsored-fee routes.

The sponsor route additionally requires every user transaction in the
group to be sent from the Algorand address bound to the presented
credential's did:key, so fees are only sponsored for the credential
holder's own transactions.

- Replace the credential-gated GET /wallet/sponsor/ with a public
  unauthenticated GET /wallet/manager/address so wallets can learn the
  Sponsor address before building a group; drop SponsorDetailDto and
  getSponsorInfo
- Add unit specs for CredentialAuthGuard (default and metadata-selected
  vct, cross-rejections, issuer/binding failures)
- Add e2e coverage for the full journey: register the custom
  configuration, issue and redeem the VC over OID4VCI, present it, and
  get the group sponsored — plus rejection of absent credentials,
  device-attestation credentials, and groups sent by other wallets

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>