Fix CARROT multi-output ephemeral keys, add subaddress/integrated address management, FFI blob export

- TX builder: emit per-output ephemeral keys (tag 0x04) for CARROT TXs
    instead of single shared key (tag 0x01)
  - Wallet: add subaddress/account creation, labeling, integrated address
    encode/decode, and bump lookahead from 50 to 10,000
  - DB: add subaddresses table with upsert/query/label/mark-used methods
  - FFI: add wallet blob export/import/rekey (PQC-encrypted)
  - CI: add WASM build target to release workflow

.github/workflows/build-release.yml

@@ -121,9 +121,32 @@ jobs:
           name: windows-x86_64
           path: prebuilt/windows-x86_64/
 
-  # ── Publish to salvium-rs-release ─────────────────────────────────────────
+  # ── WASM (Cloudflare Workers / Browser) ────────────────────────────────
+  wasm:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-unknown-unknown
+
+      - name: Install wasm-pack
+        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+
+      - name: Build WASM package
+        run: ./scripts/build-wasm.sh
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wasm
+          path: prebuilt/wasm/
+
+  # ── Publish to salvium-rs-releases ────────────────────────────────────────
   publish:
-    needs: [android, linux, macos, ios, windows]
+    needs: [android, linux, macos, ios, windows, wasm]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -171,6 +194,11 @@ jobs:
           zip -r "../../release/salvium-libs-windows-x86_64-${TAG}.zip" .
           cd ../..
 
+          # WASM
+          cd artifacts/wasm
+          tar czf "../../release/salvium-libs-wasm-${TAG}.tar.gz" .
+          cd ../..
+
           ls -lh release/
 
       - name: Push to salvium-rs-release