feat(wallet): per-wallet data isolation foundation (P1)

First phase of multi-wallet support: keep each wallet's data separate so loading
a different wallet no longer shows the previous one's data, and lay the metadata
groundwork for the wallet-files list.

- Address book scoped per wallet: AddressBookEntry gains a "scope" ("global" or a
  wallet-identity hash); the Contacts tab shows global + current-wallet contacts
  (App::activeWalletIdentityHash) with a "show in every wallet" toggle + globe
  badge. Legacy entries migrate to "global". Scope-aware de-dup allows the same
  address across different wallets.
- Wallet metadata index (data/wallet_index -> wallets.json): file-keyed cache of
  balance / address count / identity / size / last-opened / synced-here, since
  those can't be read off a wallet.dat without loading it. Populated on connect +
  address refresh (change-detecting upsert). Plus an active_wallet_file setting
  for the -wallet=<name> switch coming in P2.

Unit-tested (testAddressBookScope, testWalletIndex): migration, visibility filter,
scope-aware de-dup, upsert change-detection, save/reload round-trip.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/app.cpp

@@ -467,6 +467,10 @@ bool App::init()
     // Idempotent; a missing file is fine (returns true). Purely local — no daemon/RPC dependency.
     address_book_.load();
 
+    // Load the wallet-files metadata index (wallets.json); populated after each wallet load. Local
+    // only, missing file is fine.
+    wallet_index_.load();
+
     // If this wallet build bundles a newer daemon than the one already installed, offer to update it
     // (once per version). Fixes the trap where a wallet update carrying a newer node silently kept
     // the old binary — e.g. an old daemon lacking z_exportmnemonic blocking migrate-to-seed.