docs(contributing): anchor trust model — node is trusted, wallet is thin

[TaprootFreak]

Summary

Anchors the absolute project rule in CONTRIBUTING.md: the wallet trusts the node it talks to. The only line the node is not allowed to cross is the wallet's private key — everything else may be delegated.

The rule rejects:

• client-side proof verification,
• scan loops,
• view-key / spend-key splits,
• consistency checks against a second node,
• "node integrity" indicators in the UI,
• any other client-side mechanism whose purpose is to reduce trust in the node operator.

The escape hatch for users who do not want to trust the public operator is self-hosting, supported by a "switch node" setting that is always a single configuration value.

Why now

Established as a project-wide constraint during the aliasing-design discussion (zk-coins/docs#7). Three consequences flow from it:

1. The SDK collapses to seed + address + the small set of methods every familiar wallet SDK exposes — Cake Wallet / LayerZ / BlueWallet integration becomes a 2-day adapter.
2. Node development prioritises easy self-hosting (single container, deterministic state, no operator-specific dependencies).
3. Reviews of wallet/SDK PRs reject anti-node logic on principle, regardless of merit.

What this PR does

• Adds a "Trust model — node is trusted, wallet is thin" section near the top of CONTRIBUTING.md.
• Identical wording across all four repos (node, sdk, app, docs) so the rule reads the same wherever a contributor lands first.

Sibling PRs

• zk-coins/node#171
• zk-coins/sdk#15
• zk-coins/app#155
• zk-coins/docs#8

Test plan

• Reviewer confirms the inserted section reads coherently in this repo's CONTRIBUTING.md.
• Reviewer confirms the four sibling PRs carry identical wording (modulo placement adjustments).