feat(coinjoin): add SLIP-19 ownership proofs

[PMK]

What is this PR for?

Implement firmware-side SLIP-19 support for CoinJoin flows:

• Add SLIP-21 ownership key derivation and SLIP-19 proof generation
• Support P2WPKH and BIP-86 tweaked P2TR proof signing
• Add policy-gated CoinJoin PSBT signing with self-transfer checks
• Add disabled-by-default CoinJoin security settings
• Add focused SLIP-19 and CoinJoin PSBT tests
• Add CoinJoin feature documentation
• Add translation entries for new CoinJoin settings

See this documentation for more info about CoinJoin.

Fixes #709

Changes made to:

• Code
• Tests
• Docs
• CHANGELOG

Did you build the code and tested on device?

• Yes, build and tested on M5StickV
• Yes, build and tested on WonderMV

What is the purpose of this pull request?

• Bug fix
• New feature
• Docs update
• Other

---

With thanks to @kravens

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.44%. Comparing base (1b311fa) to head (1a1599d).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #903      +/-   ##
===========================================
+ Coverage    97.39%   97.44%   +0.05%     
===========================================
  Files           83       84       +1     
  Lines        10845    11078     +233     
===========================================
+ Hits         10562    10795     +233     
  Misses         283      283              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[PMK]

Left: the menu where the option to sign a CoinJoin transaction appears when the CoinJoin is set to enabled in the settings.
Right: when the policy is incorrect with your values it shows this message.

[qlrd]

Thxs for contribution @PMK. I will need to read SLIP-19/SLIP-21 (and their suposed SLIP*) and will be a nice learn so i could review.

Please correct-me if i made a conceptual error here, but from what i rememeber coinjoin needs PSBTv2 (being done on embit), this is another way to do coinjoin?

But since it's a SLIP*, it have a good acceptance on a hardware wallet. Let's wait others review too :)

Since the concept of coinjoin is not an air-gap workflow AFAIK, but it's a neat new workflow. So IMO would be nice to have a issue linked to this PR, since it's a new feature.

[qlrd]

Don' get the figures, they show some unexpected error or something else?

[kravens]

This is the first step to supporting remote-signing of coinjoin transactions, sadly a pure airgapped solution would disrupt rounds more than be helpful. So I'm working on the next step, a fork that allows limited communication over USB, so that we can do unattended auto-signing based on pre-approved spending policy (a bit like a HSM). Old Trezor firmware still does this, which I revived recently: https://github.com/kravens/WalletWasabi/tree/feature/trezor-coinjoin but I'd like to have cheaper self-built solutions too (where Krux is a great starting point). This probably deviates from the philosophy of not shipping any USB comm code with the firmware, let us know what you think!

[PMK]

Don' get the figures, they show some unexpected error or something else?

From the created documentation:

A CoinJoin flow usually has these steps:

1. Your wallet asks Krux to prove that it controls the coins being registered.
2. The coordinator builds a round with inputs and outputs from several people.
3. Your wallet sends the CoinJoin PSBT to Krux.
4. Krux checks the transaction against your CoinJoin policy.
5. Krux signs only if the transaction stays inside your limits.

You can personalize the policy with:

• Max fee rate sat/vB: the highest effective fee rate Krux allows for your own registered inputs. The default is 5 sat/vB.
• Max rounds: the maximum number of CoinJoin rounds your setup may run before asking you to approve again. The default is 210.
• Min self-transfer %: the minimum share of your own input value that must return to your own wallet. Higher values are stricter. The default is 95%.

If any step goes outside these limits, Krux refuses to sign.

The second screenshot is that it failed to sign. I indeed had to put a caption below it.