Add BIP39 seed phrases (SilentDragonXLite-compatible) and HD transparent keys

Derive transparent (t-addr) keys from the HD seed and add BIP39 mnemonic seed
phrases that are byte-for-byte compatible with SilentDragonXLite, so the same
24 words recover the same shielded and transparent addresses in either wallet.

HD transparent keys:
- Derive t-keys from the seed at m/44'/coin'/0'/0/i (were random CKeys).
- CHDChain gains a version-gated transparent counter; existing wallets load
  unchanged. GenerateNewKey routes through DeriveNewChildKey when enabled
  (-hdtransparent, default on).
- Restore from a seed hex via -hdseed with gap-limit pre-derivation; birthday
  pinned to genesis so the rescan is not clipped.

BIP39 seed phrases:
- Wire the vendored trezor BIP39 lib (src/crypto/bip39) into the build, fix its
  BIP39_WORDS guard, and disable the insecure mnemonic cache.
- Match SDXLite exactly: English wordlist, empty passphrase, PBKDF2 64-byte
  seed, coin type 141, ZIP-32 m/32'/141'/i' and BIP44 m/44'/141'/0'/0/i. Store
  the 32-byte entropy and expand to the 64-byte seed on demand.
- Restore via -mnemonic, create via -usemnemonic, reveal via z_exportmnemonic.

Verified by gtests including a known-answer BIP39 seed vector and z/t address
derivation checks (src/gtest/test_hdtransparent.cpp, test_mnemonic_compat.cpp).
Docs in doc/hd-transparent-keys.md and doc/seed-phrase.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/crypto/bip39/bip39.c

@@ -33,10 +33,13 @@
 #include "rand.h"
 #include "sha2.h"
 
-#if USE_BIP39_CACHE
-
+// BIP39_WORDS is used unconditionally by the wordlist helpers below, so it must
+// be defined even when the BIP39 cache is disabled (upstream places it inside
+// the cache block by mistake).
 int BIP39_WORDS = 2048;
 
+#if USE_BIP39_CACHE
+
 static int bip39_cache_index = 0;
 
 static CONFIDENTIAL struct {

src/crypto/bip39/options.h

@@ -56,8 +56,10 @@
 #endif
 
 // implement BIP39 caching
+// Disabled: caching keeps the plaintext mnemonic/passphrase/seed in a static
+// process-lifetime buffer, which we do not want in a wallet daemon.
 #ifndef USE_BIP39_CACHE
-#define USE_BIP39_CACHE 1
+#define USE_BIP39_CACHE 0
 #define BIP39_CACHE_SIZE 4
 #endif