iOS/Android: present the credential-endpoint permission instead of refusing it

#781 adds RemotePermission::Credential { domain, path, method } (RFC 0025). iOS currently refuses it: toDomainRequest() answers nil and RustProductExecutionBridge.remotePermission returns false, so a product asking for a credential endpoint is declined on this host.

That was the safe way to unbreak the build — the permission is the prompt, since it attaches a host-derived caller identity to an outbound request, and there is nothing to show the user yet.

Full support needs:

• a credential(domain:path:method:) case on Products.RemotePermissionRequest, plus its Tag and from(json:) arm
• a ProductPermission case carrying domain, path and method, so the guard can store a decision per endpoint rather than per domain
• prompt copy that names the method, path and domain, and says an identity is attached — the grant is GET /x on one host, not the host
• toDomainRequest() returning it instead of nil, and dropping the refusal in remotePermission

Android needs the same separately: it maps persisted permissions by type name (ProductPermission.fromLocal) and will error("Unknown permission type: …") on a stored credential grant once one can exist.

Trace Products.RemotePermissionRequest, ProductPermission, toDomainRequest(), RustProductExecutionBridge.remotePermission, and Android's ProductPermission.fromLocal. Done means iOS presents a method/path/domain-specific credential prompt and accepts the permission, while Android can restore a stored credential grant without reporting an unknown type.