secp256k1 signing

[r-near]

Background. NEAR supports secp256k1 access keys. Ledger devices support secp256k1 natively (it's the Bitcoin/Ethereum curve), so this is a deliberate app limitation, not a hardware one.

Current behavior. secp256k1 keys are parsed but refused — the app rejects them with a "SECP256K1 curve was used" error, and the app manifest declares only ed25519.

Work.

• Add secp256k1 to the curve manifest.
• Implement SLIP-10 / BIP32 secp256k1 key derivation and ECDSA signing via the SDK; remove the rejection on the parse + sign paths.
• Confirm NEAR's secp256k1 signature encoding (recovery byte / layout, and the hash fed to ECDSA) matches the SDK's ECDSA primitive — the one real unknown to nail down during scoping.
• Display secp256k1 keys with the secp256k1: prefix.

Acceptance. secp256k1 keys derive, display, and sign correctly against NEAR's expected signature format; the manifest advertises the curve; tests cover a secp256k1 signer.

Status note: rare on NEAR — lowest priority, but kept in the audit batch.