feat: mnemonic and derivation

[kassandraoftroy]

Summary

Closes #33 (EDW-007). Overlaps a bit with but does not complete #35 (EDW-009).

Also fixes/standardizes passwords in the wallet - strictly one password per data dir (see Wallet Password section at bottom)

EDW-007 — seed and HD derivation

Core grows a seed module: 12/24-word BIP-39 generate/parse, zeroize-on-drop, no Debug/Clone/Serialize. A SeedRecord is the derivation identity — mnemonic + networkId + profileIndex — encrypted at rest under the wallet password. This means we store profiles "uncorrelated" even if they share a seed phrase (just different profile indexes on the same seed phrase).

HD Address Derivation Path is:

m / 44' / 60' / {profileIndex}' / 0 / {j}

profileIndex defaults to 0 (but we already support non-zero profile indices and we'll handle those profiles just the same!)

Import scans used addresses in batches of 5 (nonce, ETH balance, or nonempty code, including 7702) and prints the used map + nextIndex. Scan results are not persisted; issued HD addresses and nextIndex are later profile metadata, not seed state.

Towards EDW-009

Profile create/import CLI commands already work, and persist a seed-backed profile that survives restart, with no plaintext mnemonic on disk, and profile list command works too.

What #35 still needs is a storage pattern for derived keys so create/import can attach a private-key vault, executor, and signer (SimpleSigner / SimpleExecutor / SimpleVault). That is EDW-009 / EDW-008, not this PR.

Wallet password

One decryption password per --data-dir / DATA_DIR, tracked by {data_dir}/.unlock (same Argon2id + AEAD verifier as the encrypted store header). First run sets the password and stores the .unlock file; later commands verify the password against the verifier before opening any store. edw unlock no longer creates network/; the network store is created on first edw network add. Prompting for the password (unlock, create, import, …) holds a 15-minute terminal session the same way edw unlock does.

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

[kassandraoftroy]

skipped git guardian (think its a false positive in this case, just have some dummy passwords in tests, but no actual secrets leaked)