fix: accept delegated tempo proof signers

[brendanjryan]

Summary

• accept zero-dollar Tempo proof credentials signed by an authorized access key when credential.source identifies the root wallet DID
• expose public tempo.Proof.proofSource() and tempo.Proof.parseProofSource() helpers so servers can parse credential.source without reimplementing the DID format
• add deterministic regression coverage for delegated proof signers in the Tempo server tests

Manual Verification

• Confirm the local wallet is ready with tempo wallet -t whoami.
• Use a wallet where the root wallet address differs from the active key.address so the request is signed by a delegated key.
• Start a local endpoint protected by a zero-amount tempo.charge(...) challenge.
• Call it with tempo request -s http://127.0.0.1:<port>.
• Confirm the request succeeds when credential.source identifies the wallet DID even though the proof signature was produced by the delegated key.

[brendanjryan]

dup of #332