feat(tbor): implement ECC keygen, sign, and ECDH derive

[vsonims]

Summary

Adds three stateless masked-key TBOR crypto DDI commands, mirroring the existing MBOR vault-key-handle equivalents. The private key is AEAD-GCM-256 masked and returned to the host (nothing persisted on-device); the caller passes the masked blob back on use.

Opcode	Command	Handler
0x17	EccGenerateKey	generate keypair → masked private key + wire public key
0x18	EccSign	unmask masked key in place → ECDSA r‖s over a host digest
0x19	EcdhDerive	unmask local key in place → ECDH vs. peer pub → re-mask secret

ECC import is already provided by the existing UnwrapKey (Ecc class) from the base PR; a cross-command test covers UnwrapKey-Ecc → EccSign.

Design (mirrors the sibling TBOR handlers)

• Zero-copy: keygen masks the private key straight into a reserved response slot; sign/ecdh use decode_mut to unmask the masked key in place (no scratch copy) and reserve+fill outputs.
• Secret hygiene: recovered plaintext keys/secrets are scrubbed on every return path (scope exit only resets the bump watermark — it does not zero freed DMA memory).
• Endianness: device emits PKA-native wire-LE; host-side test verification reverses per-coordinate (confirmed by passing OpenSSL ECDSA verification for all curves).
• Strict key-class handling: EccSign/EcdhDerive recover the curve via a strict from_pal::ecc_private_curve that rejects non-ECC-private kinds (incl. SdSealing); usage attrs (sign/derive) enforced post-unmask.

Changes

• Handlers: fw/core/lib/src/ddi/tbor/{ecc_generate_key,ecc_sign,ecdh_derive}.rs.
• Shared PAL mappings added to fw/core/lib/src/ddi/tbor/from_pal.rs (ecc_private, ecdh_secret, ecc_private_curve).
• Wiring: mod.rs (opcodes, dispatch, 3 classifiers), op.rs (from_tbor_opcode).
• Wire schemas (fw + host mirror) + lib.rs registration.
• Emu integration tests (13): keygen all curves/scopes/reject; sign roundtrip host-verified for all curves + UnwrapKey-Ecc→sign cross-test + rejects; ecdh all curves/scopes + reject.
• Docs: 3 command .md + README rows.

Testing

• cargo check fw core (host + Uno no_std) ✅
• clippy (fw + host) ✅ · nightly fmt ✅ · copyright ✅
• Full TBOR emu suite: 127 passed (114 baseline + 13 ECC).

Notes

• Based on feat(tbor): implement RSA-AES key unwrap (GetUnwrappingKey + UnwrapKey) #583 (tbor/unwrap-key); uses opcodes 0x17–0x19 to avoid collision with the sibling AES/HMAC branches.
• Reviewed with the code-review and security-review specialists: two secret-scrubbing gaps on error paths were found and fixed; security review found no exploitable vulnerabilities.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com