feat: add secure file-based wallet secret inputs

[dmarzzz]

Summary

Adds explicit file-backed secret inputs for non-interactive and local automation use:

• --password-file <path> everywhere --password is accepted
• --mnemonic-file <path> for imported wallets
• one shared, fail-closed secret-file reader

This keeps secrets out of process arguments without changing existing literal/path-overloaded --password behavior.

Security and compatibility

• Opt-in only; existing interactive and --password flows remain compatible.
• File and literal forms are mutually exclusive.
• On POSIX, secret files must be regular, owned by the current user, mode 0400 or 0600, and not symlinks.
• The reader uses O_NOFOLLOW | O_NONBLOCK, then validates the opened descriptor and its identity against the pre-open file metadata.
• Empty, oversized, NUL-containing, and invalid multiline inputs fail without echoing contents or local paths.
• A single trailing LF or CRLF is removed; other password whitespace is preserved.
• File-backed inputs fail closed on Windows because this implementation cannot validate Windows ACL ownership/mode safely.

Verification

• TypeScript typecheck
• Full test suite: 299 tests across 112 suites (Node 22.23.2)
• Production build
• git diff --check
• CLI coverage for create/import and existing-wallet unlock paths

Relates to #44.

[kassandraoftroy]

LGTM