feat(server): integrity envelope engine for EVM grants with HMAC verification

protobufs/integrity.proto

@@ -0,0 +1,50 @@
+syntax = "proto3";
+
+package arbiter.integrity;
+
+import "google/protobuf/timestamp.proto";
+
+message IntegrityTransactionRateLimit {
+  uint32 count = 1;
+  int64 window_secs = 2;
+}
+
+message IntegrityVolumeRateLimit {
+  bytes max_volume = 1; // U256 as fixed-width 32-byte little-endian bytes
+  int64 window_secs = 2;
+}
+
+message IntegritySharedGrantSettings {
+  int32 wallet_access_id = 1;
+  uint64 chain_id = 2;
+  optional google.protobuf.Timestamp valid_from = 3;
+  optional google.protobuf.Timestamp valid_until = 4;
+  optional bytes max_gas_fee_per_gas = 5; // U256 as fixed-width 32-byte little-endian bytes
+  optional bytes max_priority_fee_per_gas = 6; // U256 as fixed-width 32-byte little-endian bytes
+  optional IntegrityTransactionRateLimit rate_limit = 7;
+}
+
+message IntegrityEtherTransferSettings {
+  repeated bytes targets = 1; // sorted list of 20-byte addresses
+  IntegrityVolumeRateLimit limit = 2;
+}
+
+message IntegrityTokenTransferSettings {
+  bytes token_contract = 1; // 20-byte address
+  optional bytes target = 2; // 20-byte address
+  repeated IntegrityVolumeRateLimit volume_limits = 3; // sorted by (window_secs, max_volume)
+}
+
+message IntegritySpecificGrant {
+  oneof grant {
+    IntegrityEtherTransferSettings ether_transfer = 1;
+    IntegrityTokenTransferSettings token_transfer = 2;
+  }
+}
+
+message IntegrityEvmGrantPayloadV1 {
+  int32 basic_grant_id = 1;
+  IntegritySharedGrantSettings shared = 2;
+  IntegritySpecificGrant specific = 3;
+  optional google.protobuf.Timestamp revoked_at = 4;
+}