chore(tech-debt): phase 4

[tuddman]

Retire legacy privkey wrappers and stale notes

Net: +256 / -454. The 200-line shrink lands almost entirely in the library; the only net additions are the REPL / quickstart updates that construct Wallets inline (the legacy privkey: String API was a single arg; the curve-aware API takes &Wallet, so call sites grow a bit) and the CHANGELOG entries.

Removed (breaking, pre-1.0):

• The legacy privkey: String wrappers around the curve-agnostic trading and auth APIs. The _with_wallet family is the only public shape now. Specifically deleted:
  • commands::trading::send_order::send_order
  • commands::trading::cancel_order::call_cancel_order
  • commands::trading::cancel_order::call_cancel_order_from_config
  • commands::trading::deposit::call_deposit_from_config
  • commands::trading::withdraw::call_withdraw_from_config
  • commands::trading::balance::balance_from_config
  • commands::auth::authenticate_with_signature
• The dead-code legacy two-chain pretty-printer commands::trading::balance::balance plus its private-key-derived helpers (call_get_balance, call_get_locked_balance, call_get_erc20_balance, call_get_native_balance) and the balance_table helper. The address-based *_for_address variants
  • format_balance stay — aspens-admin uses them.
• The chain_client::derive_associated_token_account re-export. The function still lives at aspens::solana::derive_associated_token_account.

Updated:

• aspens-repl: uses the curve-aware _with_wallet API everywhere. Wallet construction is centralised behind a new load_trader_wallet_or_complain helper; each call site wraps the library call in async move so the executor's 'static requirement is satisfied.
• aspens-admin: Login flow now builds a Wallet and calls auth::authenticate_with_wallet directly instead of going through the deleted authenticate_with_signature wrapper.
• aspens/examples/quickstart.rs: same pattern. The example re-builds a fresh Wallet inside each async move block because Wallet is intentionally not Clone (Solana keypairs).
• CLAUDE.md: the "legacy privkey: String functions still exist as thin wrappers" paragraph is now accurate — they don't.

Not removed (audit was wrong):

• aspens-cli does use the log dep (log::LevelFilter conversion from clap-verbosity in main.rs:390-395). The audit's "unused log" item was incorrect.

All gates green locally:

• cargo test --workspace --all-features
• cargo test -p aspens --no-default-features --features evm,solana
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo deny --workspace check
• RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps --all-features
• cargo fmt --all -- --check