fix(lobstr): isolate concurrent signing callbacks - #140

Description

Replace the module-level Lobstr signing callback singleton with a correlation-ID-keyed pending-call registry. Each signing request now owns its resolve callback, reject callback, and timeout, so concurrent requests settle independently.

The SEP-7 callback URL carries the request ID, callback parsing returns both the signed XDR and ID, and callback resolution removes only the matching registry entry. Cancellation supports either one request by ID or all pending requests for teardown.

Closes #130

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that breaks existing functionality)
• Documentation update
• Chore (deps, tooling, refactoring)

How Has This Been Tested?

• Unit tests added / updated
• Integration tests added / updated
• Manual testing on Android
• Manual testing on iOS

Validated locally with:

• npm run typecheck
• npx eslint src/
• npm test -- --passWithNoTests (43 suites, 398 tests)
• Android Metro production bundle
• iOS Metro production bundle

Checklist

• My code follows the project code style
• I have performed a self-review of my own code
• I have commented on complex or non-obvious code
• I have updated the documentation where needed
• My changes generate no new warnings or lint errors
• All existing and new tests pass

Screenshots

Not applicable.

Additional Context

RootNavigator already forwards the complete Lobstr deep-link URL to resolveLobstrCallback, so no navigation change was necessary. Existing callers continue awaiting a plain Promise and do not handle correlation IDs.