feat(wallet): unify wallet secret storage on a no-serialization raw-SecretBytes vault seam

CLAUDE.md

@@ -77,7 +77,7 @@ Code lives by responsibility, not convenience:
 - **`backend_task/`** — async business logic, one submodule per domain; the authoritative enforcement layer. `TaskError` and its typed variants live in `backend_task/error.rs`.
 - **`database/`** — SQLite persistence, one module per domain.
 - **`context/`** — `AppContext` submodules (`*_db.rs`, lifecycle, settings, status).
-- **`wallet_backend/`** — the wallet orchestration seam: adapters, views, backend-side live caches, signers, the secret chokepoint, the event bridge.
+- **`wallet_backend/`** — the wallet orchestration seam: adapters, views, backend-side live caches, signers, the secret chokepoint, the event bridge. All wallet secret bytes (HD seed, imported single key, identity private key) enter/leave the vault through ONE chokepoint, `wallet_backend/secret_seam.rs` (raw `SecretBytes`, no DET-side serialization). Per-secret encryption wires in there later — grep `TODO(per-secret-encryption):` for the exact sockets. Design + migration: `docs/ai-design/2026-06-19-secret-storage-seam/`.
 - **`ui/<domain>/`** — screens (`ScreenLike`). UI may *call* `model/` validators for instant feedback but never implements its own validation.
 - **`ui/components/`** — reusable **Component-pattern widgets ONLY**: a `show()` plus a `ComponentResponse`, a display-only render widget, or component infrastructure. If it does not render egui, it is not a component.
 - **`ui/state/`** — non-widget UI state: per-screen view-models and async fetch-state caches (e.g. `TrackedAssetLockCache`). Owned by screens, may return `BackendTask`, render nothing.

benches/wallet_hydration.rs

@@ -122,6 +122,8 @@ fn seed_hd_wallets(
             is_main: i == 0,
             core_wallet_name: None,
             xpub_encoded: xpub,
+            uses_password: false,
+            password_hint: None,
         };
         let seed_hash = wallet.seed_hash();
         seed_view.set(&seed_hash, &envelope).expect("set envelope");