OPL-4574: Envelope v2 with key slots and device-p256 wrapping

[rohenaz]

Adds a versioned envelope so one encrypted .bep can be unlocked by more than one credential (key slots), including a device-bound P-256 key that uses the same ECIES layout as the Secure Enclave helper (ECDH P-256, HKDF-SHA256 with info se-vault-v1, AES-256-GCM; ephemeralPub(65) || nonce(12) || ct || tag(16)). Existing v1 files decrypt unchanged; decryptBackup transparently opens v2 files through their pbkdf2 slots.

New API: sealBackup, openBackup, inspectEnvelope, addSlot, removeSlot, rewrapBackup, isEnvelopeV2, eciesEncrypt, eciesDecrypt, and a DerivationDescriptor type available on WIF, account, and master payloads. CLI gains bbackup slots <file> to inspect a file without a passphrase.

Byte layout: BEP2 magic, version byte 0x02, u16 header length, JSON header ({v, slots[], descriptor?}), then iv(12) || AES-256-GCM(contentKey, payload). Header validation runs before any decrypt call; unknown versions, slot types, or truncated bytes fail closed.

Implemented by a Muse Spark 1.3 worker via Orchestra, then reviewed and revised in the main session: duplicated payload validation and parsing were replaced with the existing crypto.ts implementations, forwarding wrappers in index.ts replaced with re-exports, and a double parse in rewrapBackup removed.

Verification: bun run lint, bun test (173 pass), bun run build.

Linear: OPL-4574

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[linear]

OPL-4574