gui: Require strong recovery commitment

[BenWestgate]

Closes #27.

• derive a domain-separated SHA-256 commitment from the canonical root xpub
• require the separately stored commitment before restore can reach wallet mutation
• keep the 32-bit BIP32 fingerprint as diagnostic metadata only
• add the commitment to the wallet record and document the trust boundary

Validation: 971 tests pass normally and under python -O; Ruff, format, mypy, and git diff --check pass.

Stacked on #28.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7d1bf6d5d8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenWestgate]

Closing: the 256-bit commitment was concept-NACKed. Replaced by the typed-fingerprint gate in #28, with the stronger check discussed in #27.