fix(core): canonicalize P2PK keys with legacy aliases

[Egge21M]

Replaces #121 with the original two commits rebased onto current master. Their author metadata remains attributed to lescuer97.

Problem

Older coco versions serialized every P2PK key as 02 + x-only key. That remains valid for BIP340 verification, but odd-Y keys do not match the canonical compressed SEC1 identity emitted by CDK and required by the deterministic derivation vectors.

Changing the serialized identity without an alias layer would strand existing persisted keys and proofs after an upgrade or seed-based keyring restore.

Summary

• derive new P2PK keys with their canonical 02 or 03 SEC1 prefix, matching CDK and the deterministic vectors
• resolve canonical and legacy encodings bidirectionally for P2PK lookup, removal, and proof signing
• preserve existing persisted row identities and derivation metadata instead of rewriting the database
• avoid duplicate rows when an existing legacy key is imported again
• scope alias matching to P2PK keys so NUT-20 mint quote keys remain isolated
• document the compatibility behavior and add a patch changeset for @cashu/coco-core

Existing legacy rows remain unchanged. The upgraded keyring accepts either encoding and returns the persisted keypair with its stored identity.

References:

• CDK implementation: https://github.com/cashubtc/cdk/blob/dd74c9ac3e53e1b764daec60deae41b4348e707e/crates/cdk/src/wallet/p2pk.rs
• Specification work: Deterministic pay to public key generation nuts#331

Verification

• bun run --filter='@cashu/coco-adapter-tests' build
• bun run --filter='@cashu/coco-core' typecheck
• bun run --filter='@cashu/coco-core' test:unit (1,011 passed)
• bun run --filter='@cashu/coco-core' test -- test/unit/KeyRingService.test.ts (46 passed)
• bun run docs:build
• bunx prettier --check packages/core/services/KeyRingService.ts packages/core/api/KeyRingApi.ts packages/core/test/unit/KeyRingService.test.ts packages/docs/pages/keyring.md .changeset/canonical-p2pk-keys.md

[changeset-bot]

🦋 Changeset detected

Latest commit: 70082b0

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 8 packages

Name	Type
@cashu/coco-core	Patch
@cashu/coco-adapter-tests	Patch
@cashu/coco-expo-sqlite	Patch
@cashu/coco-indexeddb	Patch
@cashu/coco-react	Patch
@cashu/coco-sql-storage	Patch
@cashu/coco-sqlite-bun	Patch
@cashu/coco-sqlite	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[codecov]

Codecov Report

❌ Patch coverage is 81.08108% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.28%. Comparing base (f934fa0) to head (70082b0).
⚠️ Report is 6 commits behind head on master.

Files with missing lines	Patch %	Lines
packages/core/api/KeyRingApi.ts	0.00%	7 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #308      +/-   ##
==========================================
+ Coverage   88.27%   88.28%   +0.01%     
==========================================
  Files         131      131              
  Lines       18208    18234      +26     
==========================================
+ Hits        16073    16098      +25     
- Misses       2135     2136       +1     

Flag	Coverage Δ
core-integration	52.32% <ø> (ø)
core-unit	92.39% <81.08%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.