feat: add --ows flag to login for headless wallet creation

[kevarifin14]

Summary

Adds tempo wallet login --ows — headless alternative to passkey login. Same on-chain result, no browser needed.

tempo wallet login --ows

Why

The current login flow requires a browser for WebAuthn passkey authentication. This doesn't work for:

• AI agents running autonomously on servers
• CI/CD pipelines that need to interact with Tempo
• Docker containers and headless VMs
• SSH sessions without display forwarding
• Automated infrastructure that needs to create and manage wallets programmatically

--ows gives these environments a way to create wallets with the same on-chain security model (scoped access keys, $100 spending limit, 30-day expiry) without requiring human interaction in a browser.

What it does

1. Creates a root wallet key in the OWS encrypted vault (AES-256-GCM, scrypt KDF)
2. Generates a scoped access key (same $100 USDC limit, 30-day expiry as passkey login)
3. Root key signs a KeyAuthorization for the access key
4. Calls the same save_keys() as passkey login — keys.toml entry is structurally identical
5. Re-login reuses the same root wallet (same address, fresh access key)
6. Reauth checks (key revoked/expired) same as passkey flow
7. Analytics tracked with wallet_type: "ows" via PostHog

No changes to the signing path, keystore, or data model. Exported key material is Zeroizing-wrapped and wiped from memory after use.

Changes

File	What
Cargo.toml	Added ows-lib = "1.0.0" and ows-core = "1.0.0"
keys/ows.rs	New — create wallet, find existing, decrypt signing key. 5 tests.
keys/mod.rs	Register ows module
args.rs	Added --ows flag to Login
app.rs	Pass flag to login
commands/login.rs	Added run_ows() — mirrors passkey flow without browser

Test plan

• cargo check --workspace passes
• cargo test --package tempo-common --lib — 279/279 tests pass (274 original + 5 OWS)
• OWS create + export round-trip verified
• find_wallet by prefix works correctly
• Same wallet produces same key on re-export
• Different wallets produce different keys
• Key material is Zeroizing-wrapped
• Re-login reuses same wallet address
• Reauth checks (revoked/expired) same as passkey flow
• Existing login flow unchanged
• Tested on mainnet with real USDC:
  • Passkey → OWS: 6.90 USDC
  • OWS → Passkey: 9.80 USDC

[kevarifin14]

Blog post: https://x.com/kevarifin/status/2036869355884208446