feat: use split relay and iron disclaimer submission

[jiexi]

Explanation

• Replace KycService.submitConsents (POST /consents) with session-scoped GET/POST /sessions/{id}/disclaimers for idOS + KYC-provider consents ({ key, version } + credentialReusabilityConsentGiven).
• Record Iron T&Cs separately via POST /vendors/{vendor}/disclaimers (submitVendorDisclaimers); those content ids are no longer sent on the session disclaimer POST.
  *Consents path order: vendor T&Cs → create UKYC session → session catalog/consents → SumSub. A 409 is re-checked with a GET and only treated as success when every accepted document is consented.

References

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

High Risk
Breaking API and consent orchestration for identity/KYC flows; incorrect 409 or catalog handling could block verification or skip required legal consents.

Overview
Breaking: Removes KycService.submitConsents (POST /consents) and replaces it with three endpoints: submitVendorDisclaimers for Iron/vendor T&C ids, fetchSessionDisclaimers / submitSessionDisclaimers for the idOS + SumSub catalog using { key, version } and credentialReusabilityConsentGiven.

On the non-MoonPay consents path, KycController now runs vendor T&Cs → UKYC session create → session disclaimers → SumSub (vendor content ids are no longer bundled into session consent POSTs). acceptTermsAndStartSession accepts optional credentialReusabilityConsentGiven; T&C2 booleans map onto catalog documents. 409 on session disclaimer POST triggers a re-GET and only continues when every accepted item is actually consented—otherwise the flow fails closed and rewinds to terms.

UKYC session creation is extracted into #createUkycSession so the consents path can create the session before recording disclaimers; startSumSub skips wrapping-key/session steps when a session id already exists. Adds in-memory sessionDisclaimers / credentialReusabilityConsentGiven state and related types; docs and tests follow the new contract.

^{Reviewed by Cursor Bugbot for commit 06dc3da. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2e926c0. Configure here.}