daemon: Unify and harden credential transport lifecycle

[Preovaleo]

Hello 👋,

Summary

Follow-up to #204 and #214.

Credential transports previously handled state conversion, request completion, and cancellation in separate USB, hybrid, and NFC stream wrappers. This duplicated lifecycle logic and left several edge cases around idle cancellation, stale terminal events, and transports ending without producing a result.

This PR:

• extracts the existing push-based test helper into reusable typed scripted transports;
• replaces the transport-specific lifecycle wrappers with one shared lifecycle stream while preserving each transport's public states;
• wakes pending streams immediately when their request is cancelled;
• binds terminal events to the request that created their stream;
• takes one lifecycle snapshot and shares it across all selected transports;
• fails the request when every selected transport exits without a terminal result;
• limits each request to one active discovery stream at the trusted UI boundary;
• releases that discovery slot when the stream ends, so a later discovery attempt remains possible;
• updates the architecture documentation and changelog.

Result

The first valid terminal event completes the active request and cancels the competing transports.

Explicit cancellation no longer depends on additional transport activity. Events from stale streams cannot complete a newer request, and silent transport exhaustion produces an error instead of leaving the caller pending.

Repeated DiscoveryRequested signals cannot create concurrent discovery tasks for the same request. This is a concurrency bound rather than a single-discovery policy: once the active stream ends, another discovery attempt can start.

Scope

This PR does not change how available authenticators are enumerated, implement dynamic source-list updates, or define a new retry policy. Those remain separate concerns tracked by #32 and #206.

Testing

The daemon now has 39 unit tests, including coverage for:

• USB, hybrid, and NFC success and failure;
• explicit cancellation and cancellation while streams are pending;
• cancellation with queued transport events;
• simultaneous cancellation and terminal completion;
• stale events from an earlier request;
• concurrent terminal events from multiple transports;
• partial and global transport exhaustion;
• concurrent discovery requests and subsequent retry.

Validation performed:

• cargo test -p credentialsd --bin credentialsd — 39 tests passed
• cargo clippy -p credentialsd --bin credentialsd -- -Dwarnings
• cargo fmt --all --check
• git diff --check origin/main...HEAD

The targeted daemon test suite also passes independently at every commit in the PR.

[iinuwa]

Hello! Thanks for your contribution!

This looks like a good improvement. I typically only have 10 minutes blocks of time to do review, so this will take me quite a while to get through all these changes. Even though it seems you've split your commits well, limitations in GitHub's review features will also make it hard for me to get through these.

Could you post these as separate PRs? You could use GitHub's new stack feature to group them together if you like.