Harden wallet security

[pinebit]

Summary

Security hardening for sensitive memory handling across the wallet codebase.

• Zero sensitive strings in Wallet destructor — priv_b64, pub_b64, master_seed_b64, and mnemonic are now wiped on destruction, not just sk/pk
• Zero decoded key material — all base64_decode results containing private keys are zeroed after use (including on error paths) in load_wallet_encrypted, load_wallet_legacy, import_wallet, and recover_hd_index
• Zero JSON-internal copies — sensitive fields inside the parsed JSON object are zeroed via get_ref<string&>() before the object is destroyed
• Secure file removal — legacy plaintext wallet is now overwritten with zeros before unlinking (secure_remove)
• Zero crypto intermediates — ECDH raw shared secret (stealth.hpp), Ed25519-to-Curve25519 hash (crypto_utils.hpp), and PVAC keygen seed/decoded key (pvac_bridge.hpp)
• Platform-native secure_zero — uses SecureZeroMemory (Windows), memset_s (macOS), or explicit_bzero (glibc 2.25+) instead of a volatile loop that compilers may optimize away; inspired by Bitcoin Core https://raw.githubusercontent.com/bitcoin/bitcoin/master/src/support/cleanse.h
• Compiler hardening flags — added -Wextra, -Werror=format-security, -Wshadow globally; suppressed vendored code warnings for tweetnacl and pvac