Fix remote player SDK types and signing prefix; test remote commands

RemoteShared/SystemPlayerCredentials.swift

@@ -2,13 +2,33 @@ import Foundation
 import Security
 
 enum SystemPlayerCredentials {
+    // Derive the signing prefix from our own default Keychain group. Info.plist
+    // build substitutions cannot know the team that later re-signs an IPA.
+    private static func signingPrefix() throws -> String {
+        let marker: [String: Any] = [kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: "MusicBridge.signing-prefix.v1", kSecAttrAccount as String: "prefix"]
+        let status = SecItemAdd(marker.merging([kSecValueData as String: Data(),
+            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly]) { _, v in v } as CFDictionary, nil)
+        guard status == errSecSuccess || status == errSecDuplicateItem else { throw failure(status) }
+        var result: CFTypeRef?
+        let read = SecItemCopyMatching(marker.merging([kSecReturnAttributes as String: true,
+            kSecMatchLimit as String: kSecMatchLimitOne]) { _, v in v } as CFDictionary, &result)
+        guard read == errSecSuccess else { throw failure(read) }
+        guard let attributes = result as? [String: Any],
+              let group = attributes[kSecAttrAccessGroup as String] as? String,
+              let separator = group.firstIndex(of: "."), separator != group.startIndex else {
+            throw failure(errSecMissingEntitlement)
+        }
+        return String(group[...separator])
+    }
+
     private static func query(_ id: String) throws -> [String: Any] {
-        guard let group = Bundle.main.object(forInfoDictionaryKey: "MusicBridgeSharedKeychainGroup") as? String,
-              !group.isEmpty, !group.contains("$(") else {
+        guard let suffix = Bundle.main.object(forInfoDictionaryKey: "MusicBridgeSharedKeychainGroup") as? String,
+              suffix == "ru.yukinoki.musicbridge.remote-control" else {
             throw BridgeError.message("Подпись приложения не настроила общий Keychain для системного пульта.")
         }
         return [kSecClass as String: kSecClassGenericPassword, kSecAttrService as String: "MusicBridge.system-player.v1",
-                kSecAttrAccount as String: id, kSecAttrAccessGroup as String: group]
+                kSecAttrAccount as String: id, kSecAttrAccessGroup as String: try signingPrefix() + suffix]
     }
 
     static func save(_ connection: Connection, id: String) throws {