UMP v3 token support with Argon2id password KDF

[Stephen-Thomson]

Description of Changes

Add UMP v3 token support with Argon2id password key derivation. Introduces a
derivePasswordKey() abstraction that dispatches to Argon2id (v3 tokens) or
PBKDF2-SHA512 with 7777 rounds (legacy tokens), using the hash-wasm library.

Extends UMPToken with optional umpVersion and passwordKdf fields. Updates
buildAndSend to write v3 KDF metadata fields (umpVersion, kdfAlgorithm, kdfParams)
to on-chain tokens, and parseLookupAnswer / serializeUMPToken /
deserializeUMPToken to parse and round-trip that metadata. Exports
ARGON2ID_DEFAULT_* constants for iterations, memoryKiB, parallelism, and hashLength.
Legacy token behavior is unchanged.

Linked Issues / Tickets

N/A

Testing Procedure

Added and updated unit tests in CWIStyleWalletManager.test.ts:

• Unskipped the round-trip serialization/deserialization test for tokens with KDF
  metadata (previously skipped due to a fake-timer-incompatible setTimeout; now
  passes at ~379ms with real Argon2id)

• Legacy PBKDF2 path continues to be exercised by existing tests

• I have added new unit tests

• All tests pass locally

• I have tested manually in my local environment

Checklist:

• I have performed a self-review of my own code
• I have made corresponding changes to the documentation
• I have run npm run doc and npm run lint one final time before requesting a review
• I have run npm version patch so that my changes will trigger a new version to be released when they are merged

[BraydenLangley]

Changes have been tested in local integration and can confirm login works for both UMP formats:

• Non-v3 (legacy/PBKDF2) UMP token login succeeds (non updated toolbox with updated ump overlay)
• v3 (Argon2id metadata) UMP token login succeeds (updated toolbox with updated ump overlay)
• Repeated login attempts are stable (no intermittent profilesEncrypted parse/decrypt failures)
• Trailing PushDrop signature handling is now reliable in the parser path (valid signature is stripped; non-verifying DER-like field is not)
• Confirmed password change, and recovery key flows are working as well.

Also validated with targeted tests:
src/__tests/CWIStyleWalletManager.test.ts includes regression coverage for both signature-strip and no-strip cases.

[sonarqubecloud]

Quality Gate passed

Issues
13 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud