refactor(kyc-controller): move Moonpay frame handling out of KycController

[jiexi]

Explanation

Starting the pattern of abstracting vendor specific flows out of the KycController

References

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Medium Risk
Behavior is largely a move of authentication-critical frame/crypto logic; regressions would affect MoonPay login and token handling, though the refactor is covered by relocated unit tests and unchanged public controller APIs.

Overview
Extracts MoonPay Check/Auth frame logic from KycController into vendors/MoonPayFrameHandler, as the first step toward isolating vendor-specific flows.

KycController still exposes the same frame APIs (handleFrameMessage, buildCheckFrameUrl, buildAuthFrameUrl, buildResetFrameUrl) but delegates to a composed MoonPayFrameHandler wired with callbacks (getState, update, fail, onAuthenticated, requireTermsReacceptance). Frame keypairs, auth client tokens, message parsing, credential decryption, URL construction, and phase transitions for Check/Auth now live in the handler; clearMoonPaySession is shared from that module for state teardown on vendor switch, session recreate, and reset.

Tests move detailed frame-protocol coverage to MoonPayFrameHandler.test.ts; KycController.test.ts mocks the handler and asserts delegation, lifecycle hooks (startFlow, ensureKeypair, clear, clearAuthentication), and controller callback wiring. ARCHITECTURE.md documents the new file in the appendix.

^{Reviewed by Cursor Bugbot for commit 160ea1b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Akaryatrh]

LGTM