feat(wallet): unify wallet secret storage on one vault seam with per-secret at-rest encryption

CLAUDE.md

@@ -77,7 +77,7 @@ Code lives by responsibility, not convenience:
 - **`backend_task/`** — async business logic, one submodule per domain; the authoritative enforcement layer. `TaskError` and its typed variants live in `backend_task/error.rs`.
 - **`database/`** — SQLite persistence, one module per domain.
 - **`context/`** — `AppContext` submodules (`*_db.rs`, lifecycle, settings, status).
-- **`wallet_backend/`** — the wallet orchestration seam: adapters, views, backend-side live caches, signers, the secret chokepoint, the event bridge.
+- **`wallet_backend/`** — the wallet orchestration seam: adapters, views, backend-side live caches, signers, the secret chokepoint, the event bridge. All wallet secret bytes (HD seed, imported single key, identity private key) enter/leave the vault through ONE chokepoint, `wallet_backend/secret_seam.rs` (raw `SecretBytes`, no DET-side serialization). Per-secret at-rest encryption is implemented via `put_secret_protected`/`get_secret_protected` (Argon2id + XChaCha20-Poly1305, per-secret object-password envelope, AAD bound to `wallet_id ‖ label`); unprotected secrets use `put_secret`/`get_secret` (raw, keyless vault). The keyless-vault residual (identity keys and no-password secrets) is the deferred tier. Design + migration: `docs/ai-design/2026-06-19-secret-storage-seam/`.
 - **`ui/<domain>/`** — screens (`ScreenLike`). UI may *call* `model/` validators for instant feedback but never implements its own validation.
 - **`ui/components/`** — reusable **Component-pattern widgets ONLY**: a `show()` plus a `ComponentResponse`, a display-only render widget, or component infrastructure. If it does not render egui, it is not a component.
 - **`ui/state/`** — non-widget UI state: per-screen view-models and async fetch-state caches (e.g. `TrackedAssetLockCache`). Owned by screens, may return `BackendTask`, render nothing.

Cargo.toml

@@ -18,7 +18,7 @@ qrcode = "0.14.1"
 nix = { version = "0.31.1", features = ["signal"] }
 eframe = { version = "0.33.3", features = ["persistence", "wgpu"] }
 base64 = "0.22.1"
-dash-sdk = { git = "https://github.com/dashpay/platform", branch = "fix/wallet-core-derived-rehydration", features = [
+dash-sdk = { git = "https://github.com/dashpay/platform", branch = "feat/platform-wallet-secret-protection", features = [
     "core_key_wallet",
     "core_key_wallet_manager",
     "core_bincode",
@@ -28,12 +28,12 @@ dash-sdk = { git = "https://github.com/dashpay/platform", branch = "fix/wallet-c
     "core_spv",
     "shielded",
 ] }
-rs-sdk-trusted-context-provider = { git = "https://github.com/dashpay/platform", branch = "fix/wallet-core-derived-rehydration" }
-platform-wallet = { git = "https://github.com/dashpay/platform", branch = "fix/wallet-core-derived-rehydration", features = [
+rs-sdk-trusted-context-provider = { git = "https://github.com/dashpay/platform", branch = "feat/platform-wallet-secret-protection" }
+platform-wallet = { git = "https://github.com/dashpay/platform", branch = "feat/platform-wallet-secret-protection", features = [
     "serde",
     "shielded",
 ] }
-platform-wallet-storage = { git = "https://github.com/dashpay/platform", branch = "fix/wallet-core-derived-rehydration" }
+platform-wallet-storage = { git = "https://github.com/dashpay/platform", branch = "feat/platform-wallet-secret-protection" }
 zip32 = "0.2.0"
 grovestark = { git = "https://www.github.com/dashpay/grovestark", rev = "5b9e289cca54c79b1305d5f4f40bf1148f1eb0e3" }
 rayon = "1.8"

benches/wallet_hydration.rs

@@ -122,6 +122,8 @@ fn seed_hd_wallets(
             is_main: i == 0,
             core_wallet_name: None,
             xpub_encoded: xpub,
+            uses_password: false,
+            password_hint: None,
         };
         let seed_hash = wallet.seed_hash();
         seed_view.set(&seed_hash, &envelope).expect("set envelope");