feat(tbor): implement RSA mod exp

[vsonims]

Summary

Adds the TBOR RsaModExp command (opcode 0x1A) — the RSA private-key primitive x = y^d mod n using a caller-held masked RSA private key (imported via UnwrapKey with the RSA / RSA-CRT key class). It is the raw primitive underlying RSA decrypt / sign; the host applies and removes any padding. There is no TBOR RSA key generation — RSA keys enter the device only through UnwrapKey.

Opcode	Command	Handler
0x1A	RsaModExp	unmask masked RSA key in place → y^d mod n → reserved x slot

Design (mirrors the sibling TBOR crypto handlers)

• Unmask-in-place: decode_mut the masked key in the request buffer (no scratch copy); recover modulus size / CRT form from the blob's key kind via a strict from_pal::rsa_key (non-RSA-private kinds → InvalidKeyType).
• Permission gate: RsaOp::Decrypt requires the decrypt attribute, RsaOp::Sign requires sign (checked post-unmask).
• Exact-length y validated against the key's modulus length; result written straight into the reserved response x slot.
• Secret hygiene: the recovered plaintext key is scrubbed from the request buffer on every path.
• Endianness: y/x are PKA-native wire little-endian; the device flips internally for OpenSSL.

Changes

• Handler fw/core/lib/src/ddi/tbor/rsa_mod_exp.rs; from_pal::rsa_key mapping; dispatch + 3 classifiers in mod.rs; op.rs from_tbor_opcode.
• Wire schemas (fw + host mirror) with a 1-byte RsaOp selector + lib.rs registration.
• Emu tests: host-verified raw RSA sign/decrypt roundtrips for 2K / 3K / 4K / 4K-CRT through the full UnwrapKey(Rsa) → RsaModExp path, plus wrong-y-length and wrong-key-class rejects.
• Docs: rsa_mod_exp.md + README row.

Testing

• cargo check fw core (host + Uno no_std) ✅
• clippy (fw + host) ✅ · nightly fmt ✅ · copyright ✅
• Full TBOR emu suite: 127 passed.

Notes

• Based on feat(tbor): implement RSA-AES key unwrap (GetUnwrappingKey + UnwrapKey) #583 (tbor/unwrap-key), which was updated in this stack to make UnwrapKey DMA-budget-efficient (transient-vault masking, mirroring MBOR RsaUnwrap) so RSA-3072/4096 (CRT + non-CRT) keys can be imported within the fixed per-IO 8 KB budget — the enabler for the RSA-4K roundtrip tests here. That fix (plus RSA-4K unwrap tests) lives in feat(tbor): implement RSA-AES key unwrap (GetUnwrappingKey + UnwrapKey) #583.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com