perf:avoid wasteful to_affine inversions in ecrecover

[jotabulacios]

The ECSM ecrecover path lifted already-affine points (G, decompressed R, and the result) to Z=1 projective and called k256's to_affine, which runs a full field inversion regardless of Z — paying a ~256-mul inversion to recover coordinates we already had, 3× per recovery.

lincomb2_with_oracle/ecsm_lincomb2 now take and return AffinePoint and ecrecover uses the affine result directly. Results are identical; guards and the on-curve check are unchanged.

[jotabulacios]

/bench-prove

[github-actions]

Benchmark — ethrex 20 transfers (median of 3)

_{Table parallelism: auto (cores / 3)}

Metric	main	PR	Δ
Peak heap	73028 MB	56581 MB	-16447 MB (-22.5%) 🟢
Prove time	37.771s	30.782s	-6.989s (-18.5%) 🟢

🎉 Improvement detected — heap or time decreased by more than 5%.

✅ Low variance (time: 1.4%, heap: 1.0%)

_{Commit: 29de893 · Baseline: cached · Runner: self-hosted bench}