feat: add trezor receive - #1189

Greptile Summary

Adds hardware-wallet receiving to the existing receive sheet, including watcher-backed address resolution, BIP21 editing, and on-device Trezor verification.

• Adds a Trezor receive tab with QR, copy, share, details, and device-verification actions.
• Resolves the next unused watcher address with an account-scan fallback.
• Adds passphrase-aware verification state and watcher event coverage.
• Updates bitkit-core and adds repository, view-model, invoice utility, and journey tests.

Confidence Score: 4/5

The PR should not merge until receive amount and note state is scoped so Savings edits cannot silently alter the Trezor payment request.

The Trezor QR directly consumes the same BIP21 metadata updated by Savings editing, causing a request for one account to be displayed for another account with unintended payment details.

Files Needing Attention: app/src/main/java/to/bitkit/ui/screens/wallets/receive/ReceiveQrScreen.kt, app/src/main/java/to/bitkit/ui/screens/wallets/receive/ReceiveSheet.kt

Sequence Diagram

sequenceDiagram
  participant U as User
  participant UI as Receive Sheet
  participant VM as Hardware Receive VM
  participant HW as Hardware Wallet Repo
  participant W as Watcher
  participant T as Trezor

  U->>UI: Open hardware-wallet receive
  UI->>VM: loadAddress(walletId)
  VM->>HW: getReceiveAddress(walletId)
  HW->>W: Read next unused address
  alt Watcher address available
    W-->>HW: Address and derivation path
  else Watcher state unavailable
    HW->>T: Scan public account
    T-->>HW: First unused address
  end
  HW-->>VM: Hardware receive address
  VM-->>UI: Display QR and details
  U->>UI: Verify on device
  UI->>VM: verifyAddress()
  VM->>HW: verifyReceiveAddress()
  HW->>T: Display address at derivation path
  T-->>HW: Derived address
  HW-->>VM: Match or mismatch

_{Reviews (1): Last reviewed commit: "feat: add trezor receive" | Re-trigger Greptile}

PLS add QA notes and Manual Tests + Automated Tests sections with details like we usually do for apps PRs. (this is more about formatting than content, content is a bit already there, just not structured in the same format we usually do)

Updated the PR description with structured QA Notes, Manual Tests, and Automated Tests sections. I left the manual checks unchecked until they are run on Android.

Tested on emulator and device (Samsung S22 + Trezor Safe 7).

Generally all good. Able to present the receive address, verify the address on the device, etc.

One observation (looks intentional in code, but may be misleading to the user): with 2+ paired hardware wallets (e.g. standard + passphrase), Home → Receive does not show the Trezor tab, so there is no hardware receive address from that entry point. Fine to defer to a follow-up PR — if that's the case, let's create a ticket for this.

Steps to reproduce

1. Pair a Trezor (standard wallet). Home should show one hardware wallet tile.
2. Add a passphrase wallet on the same device (Paired → Passphrase → enter passphrase). Home should now show two hardware wallet tiles.
3. From the main/home screen, tap Receive.
4. Only Savings / Spending tabs are shown. No Trezor tab, so you cannot get a hardware receive address.

Expected (or less misleading)

Home → Receive either shows a Trezor tab (or a wallet picker) when more than one hardware wallet is paired, or makes it clear that hardware receive is only available from the specific wallet screen.

Workaround

Open the specific hardware wallet screen first, then Receive. That path still shows the address.

Recording

The single-wallet hardware Receive flow is green and the earlier change requests are resolved. I filed #1204 for the requested Home Receive wallet picker when multiple hardware wallets are paired. @ovitrif please re-review the current head so the stale change-request state can be cleared.

Fixed all three review findings in signed commit d42064c: preserved newer watcher addresses against the fallback race, added the hardware Edit Invoice return-path regression, and added receive-specific passphrase-copy coverage. The focused unit suite passes, the Compose test suite compiles, and detekt passes. @ovitrif please re-review when fresh CI is ready.