feat: add custody key management foundation

[ShashankShekhar31]

Summary

Implements custody key-management foundation while keeping custodial infrastructure separate from the self-custody wallet security boundary.

Changes

• Added dedicated @crypto-wallet/custody-core package.
• Added provider-neutral KeyManagementProvider abstraction.
• Added opaque custody key references and custody tiers:
  • Hot
  • Warm
  • Cold
• Added deterministic local key-management provider for development/testing.
• Added custody request pipeline:
  • Request
  • Policy / Risk
  • Authorization
  • Signing
  • Broadcast
  • Monitoring
• Added custody strategy and pipeline tests.
• Added Vitest configuration excluding generated dist tests.
• Added ADR-002 documenting:
  • Custody trust boundary
  • Hot/warm/cold strategy
  • Signing pipeline
  • Future AWS KMS / CloudHSM adapters
  • Future MPC / multisig direction
  • Key ceremony
  • Key rotation
  • Backup/recovery
  • Disaster recovery
  • Security boundaries
• Updated docs/ARCHITECTURE.md to document the dedicated custody boundary.
• Updated pnpm-lock.yaml only for the new workspace package.

Validation

• pnpm --filter @crypto-wallet/custody-core test — 20 tests passed
• pnpm --filter @crypto-wallet/custody-core typecheck — passed
• pnpm --filter @crypto-wallet/custody-core build — passed
• pnpm typecheck — passed
• pnpm test — passed
• pnpm build — passed
• pnpm lint — passed
• pnpm format:check — passed
• git diff --cached --check — clean

Security Notes

The local key-management provider is for deterministic development/testing only and is not production-grade custody.

Production KMS, CloudHSM, MPC, multisig, physical cold storage, production key ceremonies, and managed disaster recovery remain future production capabilities.

Raw private keys are not exposed through the provider-neutral custody application interface.