AutoSigning grants resolve from a peer-supplied product id on the SSO sign_vrf path

SigningHostSsoService::sign_vrf (runtime/signing_host/sso_service.rs:449) passes the
peer-supplied request.calling_product_id into SigningHost::sign_vrf, which feeds it to
has_auto_signing_grant (runtime/signing_host.rs:276) — the check that decides whether to
raise the confirmation.

AutoSigning grants are only ever issued to locally hosted products: grant_auto_signing
(:246) is reachable only from allocate_resources (:1056), and the SSO allocation path
ships the subtree secret to the peer instead of recording a grant. So a paired host that
names a locally granted product (calling_product_id = "myapp.dot") gets a prompt-free
signature over that product's account.

The peer is already an authenticated paired host, so this is a prompt bypass rather than
remote key access — but the confirmation is the control the grant model rests on, and the
peer chooses the field that waives it.

Not reachable from sign_raw / sign_payload / create_transaction: those
ProductAuthority methods take no caller id, and the SSO service raises its own
confirmation for them.

Fix

Distinguish the callers by type so a relayed request cannot name a grantable product:

pub(crate) enum AuthorityCaller {
    LocalProduct { product_id: String },
    PairedHost { claimed_product_id: String },
}

ProductAuthority::sign_vrf takes &AuthorityCaller; has_auto_signing_grant returns
false unless the caller is LocalProduct. The claimed id still reaches the confirmation,
so the review the user answers is unchanged.

Regression test: grant AutoSigning to a locally hosted myapp.dot, drive
SigningHostSsoService::dispatch with a frame claiming that product, assert exactly one
SignVrfReview.

Start with SigningHostSsoService::sign_vrf in runtime/signing_host/sso_service.rs:449, then trace ProductAuthority::sign_vrf and has_auto_signing_grant in runtime/signing_host.rs. Add the caller distinction described in the issue and run the SSO dispatch regression test: a paired-host frame claiming locally granted myapp.dot should produce exactly one SignVrfReview.