[codex] Add BRC-38/39 wallet portability

[ty-everett]

Summary

• Adds the Wallet Toolbox storage/portable module for BRC-38 plaintext wallet export/import and BRC-39 encrypted export/import.
• Exports the portable APIs from the all, client, and mobile storage barrels.
• Adds focused SQLite and BRC-39 tests for canonical JSON conversion, restore, merge remapping, encrypted headers, and rejection cases.

Why

Wallet Toolbox already has chunked synchronization and merge behavior for BRC-40, but it did not expose the BRC-38 plaintext portability format or the BRC-39 encrypted download/import envelope. These APIs give consumers a library-only path to export, restore, and merge user wallet data while keeping BRC-40 sync semantics separate.

Details

• BRC-38 export builds a one-user closure, excludes monitor events, canonicalizes JSON locally, converts dates to UTC ISO strings, converts bytes to padded base64, decodes JSON-in-string fields, sorts tables, and validates relationships.
• BRC-38 restore requires an otherwise empty target storage and preserves source IDs and operational values.
• BRC-38 merge imports through the existing BRC-40 sync merge machinery, preserves the target active storage setting, remaps relationships, and remaps imported sync maps.
• BRC-39 uses the WDAT binary header, big-endian parameters, reserved-zero validation, hash-wasm Argon2id defaults, NFC-normalized passwords, and @bsv/sdk AES-GCM with an explicit nonce.
• Added an SDK AES-GCM type shim because the installed SDK exposes the runtime subpath through package exports, while this package still compiles with legacy moduleResolution: node.

Validation

• npm run build
• npx ts-standard src/storage/portable/index.ts
• npx ts-standard src/types/bsv-sdk-aesgcm.d.ts
• npx jest test/storage/portable.test.ts --runInBand
• npx jest test/storage/idb/update.test.ts --runInBand

Full non-manual Jest suite was also attempted with npx jest --testPathIgnorePatterns=man.test.ts --runInBand. It hit test/storage/idb/update.test.ts › 2_update ProvenTxReq with a fake-indexeddb AbortError; that same file passes when rerun in isolation.