feat(wallet): add BRC-98 ECPM semantic module - #488

…-side

Supersedes bsv-blockchain#487, which was overbuilt. That branch added two methods, a wire call
code and substrate plumbing across six transports. This is the single operation
actually missing, and nothing else.

Context. Masking a point through a BRC-100 wallet is already possible today, via
revealCounterpartyKeyLinkage plus decrypt, and masks produced that way commute
across independent wallets. What has no route through the interface is removing
a mask: that needs multiplication by the modular inverse of the derived key.
Feeding a*C back through the linkage recipe yields a^2*C, not C.

The primitives already exist and this method composes them rather than
introducing anything new:

  const masked   = new PublicKey(key.deriveSharedSecret(point))
  const inverse  = new PrivateKey(key.invm(new Curve().n))
  const unmasked = inverse.deriveSharedSecret(masked)   // === point

That composition requires the private key in application memory. WalletInterface
exposes 29 methods and no route to a scalar -- keyDeriver is a property of the
in-process class, not part of the interface, so over a substrate there is none.
An application whose keys live in a wallet therefore cannot complete the second
step. This method runs both steps where the key already is. The first test
asserts the output is identical to the composition above, so the behaviour is
pinned to the existing primitives rather than to a new definition.

Optional, deliberately. BRC-100's value is that it does not change, so a method
added later cannot be mandatory: declaring it required on WalletInterface broke
23 call sites across every substrate plus the KV store, registry and identity
clients, and declaring it required on ProtoWallet broke @bsv/wallet-toolbox,
where Wallet, PrivilegedKeyManager and the wallet managers satisfy the class
structurally without extending it. Applications feature-detect and degrade. Wire
substrate support is deliberately excluded here; it needs a call code, which is
an interface-version decision rather than a library one.

Key derivation is mandatory rather than stylistic. For a counterparty point Q,
d*Q IS the ECDH shared secret with Q, so performing this with a spending or
identity key would hand any caller that secret and break encryption to that
counterparty. The key is always derived from protocolID/keyID/counterparty and
no identityKey option is offered.

On validation: PublicKey.fromString accepts '02' + 'ff'.repeat(32), an
x-coordinate greater than the field prime, reduces it silently to 0x1000003d0,
and validate() then returns true. A test asserts both halves of that so the
reason for the range check is visible. The check runs before the parser, since
the parser performs the reduction. go-sdk has the same behaviour independently.

Verified: tsc -b clean, oxlint --deny-warnings clean, prettier clean on the
files this adds to (the two existing warnings in Wallet.interfaces.ts predate
it), full sdk suite green at 157 suites / 5925 tests, and wallet-toolbox at its
4 pre-existing TS2307 baseline with 0 attributable here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CI failure on bsv-blockchain#488 was six lanes -- merge-gate, build-and-test, browser
packages, SDK coverage, wallet browser and wallet mobile -- all one cause: bundle
size budgets, and zero type errors anywhere.

Measured rather than guessed. Building the UMD bundle from main's SDK gives
554475 bytes against a 555000 budget, so the ratchet was sitting 525 bytes above
head. multiplyPoint adds 963, which crosses it. These budgets are deliberate
ratchets set just above current size, so any real addition trips them and the
fix is to advance them by what the addition actually costs.

Reduced the cost before raising anything: the error messages carried a redundant
'the supplied'/'the result is' phrasing that bought no diagnostic value, since
the stack already names the function. Trimming those took the delta from 1043 to
963 bytes. Tests still pass -- they match on the specific part of each message,
not the prose.

Six raw budgets advanced to the next 1000-byte boundary above the observed size,
matching the existing convention:

  sdk umd          555000 -> 556000  (observed 555438)
  sdk esbuild      560000 -> 561000  (observed 560710)
  sdk vite         742000 -> 743000  (observed 742268)
  message-box umd  510000 -> 511000  (observed 510105)
  wallet client    1607000 -> 1608000 (observed 1607943)
  wallet mobile    3367000 -> 3368000 (observed 3367997)

Only the raw dimension moves. The checker throws on the first dimension over
budget, which would have meant discovering these one CI round at a time, so I
instrumented it locally to print every measurement at once and then restored it
unmodified. That surfaced the esbuild and vite overages before CI reported them.
Compressed dimensions have far more slack -- gzip sits 2808 under and brotli
4044 under, against 562 for raw -- because a kilobyte of new source compresses to
a few hundred bytes. CI agrees: every failing lane named raw and nothing else.

Verified: sdk test:browser passes the full exact-tarball browser contract, tsc -b
clean, oxlint clean repo-wide, prettier clean, and the multiplyPoint suite green
at 10 tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>