refactor(crypto): drop btcd/btcutil dependency, inline BIP32 derivation

[cheggaaa]

Removes github.com/btcsuite/btcd and github.com/btcsuite/btcutil entirely (replaces #567).

The only usage was hdkeychain in ethereumKeyFromMnemonic (Ethereum key derivation for Any Naming Service). This PR replaces it with a ~100-line implementation in util/crypto/bip32.go built on stdlib HMAC-SHA512 and decred/dcrd/dcrec/secp256k1/v4, which was already in the dependency graph via libp2p (it just moves from indirect to direct).

Compatibility — derived keys must stay bit-for-bit identical, since user Ethereum identities depend on them. The old code used DeriveNonStandard, which carries the btcsuite issue #172 quirk (intermediate private keys shorter than 32 bytes are used unpadded in hardened derivation, affecting ~1/256 of derivation steps). The reimplementation reproduces this exactly. Verified by differential fuzzing against the old library:

• 40,000 random seed/path derivations (851 naturally hitting the short-key quirk) — byte-identical
• 10,455 derivations from deliberately constructed short (25–31 byte) parent keys — byte-identical
• 500 end-to-end mnemonic → Ethereum key derivations through the public API — byte-identical
• existing fixed test vectors (TestMnemonic_ethereumKeyFromMnemonic) pass unchanged

Why: the btcd module is a huge dependency that keeps triggering security/license red flags (e.g. the dependabot bump in #567 fails to even build, because btcec moved to a separate module in btcd ≥ 0.23).

🤖 Generated with Claude Code

[github-actions]

New Coverage	58.6% of statements
Patch Coverage	90.0% of changed statements (36/40)

---

^{Coverage provided by https://github.com/seriousben/go-patch-cover-action}