feat(lite): vendor SDXL backend source; source deps from git.dragonx.is

Vendor the two local Rust crates that build the lite backend artifact into
third_party/silentdragonxlite/ (the qtlib C-ABI wrapper + the silentdragonxlitelib
core, with proto/res and all the lite-send fixes), and point
build-lite-backend-artifact.sh's default --backend-dir there, so the lite wallet
builds without the upstream SilentDragonXLite repo.

External build inputs are now only the Rust toolchain + git.dragonx.is + crates.io:
- the 6 librustzcash git deps point at the git.dragonx.is/DragonX/librustzcash
  mirror (pinned rev acff1444), not git.hush.is;
- the Sapling params are gitignored (not committed, no Git LFS) - the build fetches
  them from the git.dragonx.is/DragonX/zcash-params 'sapling-v1' release and verifies
  their SHA-256 before rust-embed bakes them in (ensure_sapling_params).

For fully offline builds, cargo vendor into lib/vendor/ and add a vendored-sources
redirect (vendor/ is gitignored; the script symlinks it into the prepared dir).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/build-lite-backend-artifact.sh

@@ -7,7 +7,7 @@ PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 
 ABI_VERSION="sdxl-c-v1"
 LINK_MODE="imported"
-BACKEND_DIR="$PROJECT_ROOT/external/SilentDragonXLite/lib"
+BACKEND_DIR="$PROJECT_ROOT/third_party/silentdragonxlite/lib"
 BACKEND_SOURCE_DIR=""
 BUILD_BACKEND_DIR=""
 BACKEND_DEPENDENCY_DIR=""
@@ -314,6 +314,33 @@ validate_backend_dependency_source() {
     fi
 }
 
+# Ensure the Sapling proving params are present in the core crate (rust-embed bakes them in at build
+# time). They are the fixed Zcash trusted-setup output — not buildable — so fetch + verify them from
+# git.dragonx.is when absent. Override the source with SAPLING_PARAMS_BASE_URL.
+SAPLING_PARAMS_BASE_URL="${SAPLING_PARAMS_BASE_URL:-https://git.dragonx.is/DragonX/zcash-params/releases/download/sapling-v1}"
+ensure_sapling_params() {
+    local dir="$1"
+    [[ -n "$dir" ]] || return 0
+    mkdir -p "$dir"
+    local specs=(
+        "sapling-spend.params:8e48ffd23abb3a5fd9c5589204f32d9c31285a04b78096ba40a79b75677efc13"
+        "sapling-output.params:2f0ebbcbb9bb0bcffe95a397e7eba89c29eb4dde6191c339db88570e3f3fb0e4"
+    )
+    local spec name want path got
+    for spec in "${specs[@]}"; do
+        name="${spec%%:*}"; want="${spec##*:}"; path="$dir/$name"
+        if [[ -f "$path" ]] && [[ "$(compute_sha256 "$path")" == "$want" ]]; then
+            info "sapling param present and verified: $name"
+            continue
+        fi
+        info "fetching $name from $SAPLING_PARAMS_BASE_URL"
+        curl -fsSL "$SAPLING_PARAMS_BASE_URL/$name" -o "$path" || die "failed to download sapling param: $name"
+        got="$(compute_sha256 "$path")"
+        [[ "$got" == "$want" ]] || { rm -f "$path"; die "sapling param $name sha256 mismatch (got $got, want $want)"; }
+        info "downloaded and verified $name"
+    done
+}
+
 prepare_backend_source() {
     BUILD_BACKEND_DIR="$BACKEND_SOURCE_DIR"
 
@@ -348,6 +375,9 @@ prepare_backend_source() {
     [[ -f "$BACKEND_SOURCE_DIR/Cargo.lock" ]] && ln -s "$BACKEND_SOURCE_DIR/Cargo.lock" "$prepared_root/Cargo.lock"
     [[ -d "$BACKEND_SOURCE_DIR/.cargo" ]] && ln -s "$BACKEND_SOURCE_DIR/.cargo" "$prepared_root/.cargo"
     [[ -d "$BACKEND_SOURCE_DIR/libsodium-mingw" ]] && ln -s "$BACKEND_SOURCE_DIR/libsodium-mingw" "$prepared_root/libsodium-mingw"
+    # Vendored crate deps (offline builds): the .cargo/config.toml's vendored-sources directory is
+    # "vendor" relative to the build root, so expose it inside the prepared root too.
+    [[ -d "$BACKEND_SOURCE_DIR/vendor" ]] && ln -s "$BACKEND_SOURCE_DIR/vendor" "$prepared_root/vendor"
     [[ -f "$BACKEND_SOURCE_DIR/silentdragonxlitelib.h" ]] && ln -s "$BACKEND_SOURCE_DIR/silentdragonxlitelib.h" "$prepared_root/silentdragonxlitelib.h"
 
     local replacement="silentdragonxlitelib = { path = \"$BACKEND_DEPENDENCY_DIR\" }"
@@ -489,6 +519,8 @@ build_with_cargo() {
         export SODIUM_LIB_DIR="$BUILD_BACKEND_DIR/libsodium-mingw"
     fi
 
+    [[ -n "$BACKEND_DEPENDENCY_DIR" ]] && ensure_sapling_params "$BACKEND_DEPENDENCY_DIR/zcash-params"
+
     local cargo_cmd=(cargo build --locked --lib --release)
     if [[ -n "$RUST_TARGET" ]]; then
         cargo_cmd+=(--target "$RUST_TARGET")