Migrate KASRewrapClient from /kas/v2/* REST to /kas.AccessService/* ConnectRPC

[arkavo-com]

Context

The opentdf-platform Go server only exposes KAS over ConnectRPC at:

• POST <kas_url>/kas.AccessService/PublicKey
• POST <kas_url>/kas.AccessService/Rewrap

It has no /kas/v2/* REST routes — those were a gRPC-gateway compatibility layer that the platform no longer ships. A request to /kas/v2/kas_public_key against a current platform returns 404.

The official Go SDK talks exclusively to the ConnectRPC paths. Any iOS client targeting a deployment where the upstream KAS is opentdf-platform — including the Arkavo edge where arks reverse-proxies to a platform process — will fail to rewrap.

Goal

Switch KASRewrapClient (and the rest of the Swift call sites) to ConnectRPC so they talk to the platform's canonical surface.

Scope

• OpenTDFKit/KASRewrapClient.swift — the primary client. Replace the REST POST in rewrapNanoTDF(...) with a ConnectRPC unary call.
• OpenTDFKitCLI/Commands.swift — any CLI subcommands hitting the REST path.
• OpenTDFKitTests/IntegrationTests.swift — mock and assertions need to speak Connect.

Open design questions (for the implementer)

• Connect client choice. Use connectrpc/connect-swift (official, generated from proto) or hand-roll URLSession POSTs against the well-known Connect URL shape (POST <base>/<service>/<method> with content-type: application/json). Hand-rolling is small and matches the existing URLSession patterns in this codebase; connect-swift brings type safety + retry/streaming primitives we don't currently need.
• Request envelope. Today the request body is JSON containing signedRequestToken (JWT wrapping an UnsignedRewrapRequest). That envelope is unchanged — only the URL and content-type semantics change (Connect uses content-type: application/json for unary, same as today, but the URL path becomes /kas.AccessService/Rewrap).
• Backward compat. Keep a transport: .restV2 | .connect enum on the client for a transition period? Existing iOS app builds against older KAS servers would break otherwise.
• Error decoding. Connect returns { code: \"...\", message: \"...\" } on non-2xx; map to existing throwing patterns.

Acceptance criteria

• KASRewrapClient.rewrapNanoTDF hits /kas.AccessService/Rewrap.
• Public-key fetch (wherever it lives) hits /kas.AccessService/PublicKey.
• OpenTDFKitCLI and OpenTDFKitTests/IntegrationTests build and pass against a Connect-speaking mock.
• Round-trip test against a real opentdf-platform instance succeeds.
• README/usage docs updated.

Related

• Arkavo edge deployment using arks → platform reverse proxy: feat(proxy): optional reverse-proxy to opentdf-platform arkavo-rs#54
• opentdf-platform SDK reference: sdk/kas_client.go getPublicKey and Rewrap