feat: derive the btc wallet from the mintlayer seed

[erubboli]

One seed, both chains — closes the gap for stacks where the bitcoin profile is enabled after setup.

• bdk-wallet: create accepts scan_from; restores default to a full scan (horizon 0) so old UTXOs on linked seeds are found; generated seeds keep the now-horizon.
• New POST /api/bitcoin/link-seed: session + fresh TOTP + wallet password → server-side unlock → seed reveal → sidecar derive → re-lock in finally. The seed never leaves the server (no echo, no logs).
• Setup flow unchanged (links at birth), now passes scan_from=now for freshly generated seeds.
• Bitcoin page: 'Use my Mintlayer seed' is the primary card (password + 2FA); manual restore and independent create demoted.
• Tests: route contract (gates, re-lock on every path, 403/409 mapping, seed never in responses), client body shape, sidecar horizon logic.