feat: add host function API for delegate context and secrets access

[iduartgomez]

Summary

This PR adds a cleaner API for delegates to access context and secrets via an opaque DelegateCtx handle passed to the process() function. This eliminates the need for message round-trips (GetSecretRequest/GetSecretResponse) and allows synchronous access during a single process() call.

Breaking Change

DelegateInterface::process signature now takes a DelegateCtx as the first argument:

fn process(
    ctx: &mut DelegateCtx,
    parameters: Parameters<'static>,
    attested: Option<&'static [u8]>,
    message: InboundDelegateMsg,
) -> Result<Vec<OutboundDelegateMsg>, DelegateError>;

API

The DelegateCtx provides unified access to both temporary context and persistent secrets:

Context Methods (temporary state within a batch)

• ctx.read() - Read current context bytes
• ctx.write(data) - Write new context bytes
• ctx.len() - Get context length
• ctx.clear() - Clear the context

Secret Methods (persistent encrypted storage)

• ctx.get_secret(key) - Get a secret by key
• ctx.set_secret(key, value) - Store a secret
• ctx.has_secret(key) - Check if a secret exists
• ctx.remove_secret(key) - Remove a secret
• ctx.get_secret_len(key) - Get secret length without fetching value

Changes

• Add delegate_host.rs with unified DelegateCtx type
• Add error_codes module with standardized host function error codes
• Update DelegateInterface trait signature (breaking change)
• Update #[delegate] macro to create handle and pass to process()
• Remove feature gates - DelegateCtx is always available

Example Usage

#[delegate]
impl DelegateInterface for MyDelegate {
    fn process(
        ctx: &mut DelegateCtx,
        _params: Parameters<'static>,
        _attested: Option<&'static [u8]>,
        message: InboundDelegateMsg,
    ) -> Result<Vec<OutboundDelegateMsg>, DelegateError> {
        // Read/write context directly
        let data = ctx.read();
        ctx.write(b"new state");

        // Access secrets synchronously - no round-trip!
        if let Some(key) = ctx.get_secret(b"private_key") {
            // use key...
        }
        ctx.set_secret(b"new_secret", b"value");

        Ok(vec![])
    }
}

Error Codes

Host functions return negative values to indicate errors:

Code	Meaning
0	Success
-1	Called outside process() context
-2	Secret not found
-3	Storage operation failed
-4	Invalid parameter
-5	Context too large
-6	Buffer too small

Related

Requires corresponding runtime changes in freenet-core PR #2844 to provide the host functions.

[AI-assisted - Claude]