vaultId, then
opens the request with session.vaultRequests.create. Endstate builds the
approval from the vault the brand allows, so the page names only the vault id
eligibility()
returned. The request reads pending until the vault confirms it has the item.
Rejects with vault.not_permitted when the brand does not allow that vault,
with vault.in_progress when the item already has an open request, with
auth.forbidden when this wallet does not hold the item, with wallet.timeout
when the wallet did not sign within timeouts.signMs (15 seconds by default),
and with wallet.destroyed if the wallet has been destroyed. Nothing is opened
when the signature fails.

