keep-core: hardening & test-coverage backlog (4 items)

[kwsantiago]

Backlog of hardening / test-coverage findings in keep-core, verified still-open against current code by an automated triage pass. Each is an independent, pickup-able task — pick one and open a PR.

Findings

• NIP-49 encrypt concat buffer not zeroized — The salt+nonce+ciphertext concat Vec in nip49::encrypt is still not zeroized after bech32 encoding (keep-core/src/keys.rs:324-334); no Zeroizing wrapper added.
• NIP-49 key_security_byte hardcoded to 0x01 (unknown handling) — key_security_byte is still hardcoded to 0x01 at keep-core/src/keys.rs:313 with no configurability based on key provenance.
• No tests for get/set_active_share_key in keep-core — Only is_valid_hex_pubkey has a test (keep-core/src/lib.rs:2216); get_active_share_key/set_active_share_key (lib.rs:958-990) and write_restricted still have no unit tests.
• Rotation verify_rotation_integrity compares descriptors in plaintext without constant-time comparison — verify_rotation_integrity still compares descriptor/network fields with plain == / != (keep-core/src/rotation.rs:737-745) rather than constant-time comparison.

Grouped from individual tracked items; close each checkbox as its PR merges.