feat(kyc-controller): move moonpay keypair generation out of constructor

[jiexi]

Explanation

• Moves moonpay keypair generation out of the constructor and into initialize() when moonpay is passed as the vendor

References

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Medium Risk
Changes when MoonPay frame keys exist and how encrypted frame credentials are decrypted—callers must initialize with MoonPay before building Check/Auth URLs, which may be a breaking integration change.

Overview
MoonPay Check/Auth frame crypto is no longer created in the constructor. The controller keeps a nullable #moonpayFrameKeypair that is generated on initialize() when the vendor is MoonPay (or lazily on a repeat initialize mid-flow if the keypair was missing), and cleared when switching to a non-MoonPay vendor via initialize or createVendorCustomer.

Frame URLs and credential handling now depend on that keypair. buildCheckFrameUrl and buildAuthFrameUrl return null without it; frame credential decryption runs only when both an envelope and the MoonPay keypair are present.

Tests were updated so helpers call initialize({ vendor: 'moonpay' }) where needed, envelopeFor is async, and stale-completion cases no longer rely on a constructor-time key.

^{Reviewed by Cursor Bugbot for commit 7cce858. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b7217aa. Configure here.}

[jiexi]

controller hasn't been released yet. No changelog entries will actually survive after the first release. Marking this no-changelog to save some time

[Akaryatrh]

LGTM