Session keys: back "Sync from chain" with the subgraph instead of the Blockscout API

(written by my agent)
the session-keys console page has a "Sync from chain" button that discovers a connected wallet's session keys from `SessionKeyRegistry` `AuthorizationsUpdated` event history and merges them into the browser-local inventory.

Today that scan calls Blockscout's Etherscan-compatible `getLogs` API (mainnet + calibration). Blockscout is already the app's default block explorer for tx links, but this is the app's only *data* dependency outside the Goldsky subgraph and Glif RPC. Direct RPC is not an option: Glif's public endpoint serves only ~10.8k blocks of log history, and the registry deployed at block 5,459,604 (mainnet) / 3,185,523 (calibration), so full-history `eth_getLogs` fails with `requested block is outside available upstream range`.

Two reasons to move it first-party:

1. **Dependency**: sync availability currently tracks Blockscout uptime and API stability.
2. **API quirk we had to defend against**: Blockscout's `topic0`/`topic1` filters silently fall back to "no filter" when the filtered value has never appeared in the contract's logs — exactly the first-time-sync case. The client re-verifies every returned log's topics before decoding so a wallet with zero grants can never import someone else's keys. A subgraph query is precise by construction and deletes this whole defense.

Proposal: index `AuthorizationsUpdated` in `packages/subgraph` (schema + mappings + Matchstick tests, both networks) and swap the sync fetch to a subgraph query. The fold/merge logic and localStorage records are source-agnostic, so the swap is invisible to users — only the fetch module (`utils/sessionKeyChain.ts`) changes.

Start in packages/subgraph with the schema, mappings, and existing Matchstick tests for both networks, then inspect utils/sessionKeyChain.ts to understand the current sync fetch. Index AuthorizationsUpdated and replace the fetch with a subgraph query while preserving the existing fold/merge behavior. Done means both network subgraphs pass their tests and Sync from chain no longer depends on Blockscout.

Written by the indexing model from the issue text.