feat: Add identity seed generation for deterministic derivation

[umwelt]

Summary

Adds generate_identity_seed() function to support seed-anchored identity architecture where cryptographic seed is the root of trust, not PQC keypairs.

Changes

• Add src/seed.rs module with generate_identity_seed()
• Export generate_identity_seed from lib.rs
• Add unit tests for seed generation (64 bytes, non-zero, unique)

Purpose

Enables deterministic identity derivation in lib-identity while keeping PQC keypairs as random, attached capabilities. This resolves the fundamental limitation that pqcrypto-* crates don't support seeded keypair generation.

Architecture Impact

This supports the seed-anchored identity model:

seed (root of trust)
 ├─ DID = did:zhtp:{Blake3(seed || "ZHTP_DID_V1")}
 ├─ zk_identity_secret = Blake3(seed || "ZHTP_ZK_SECRET_V1")
 ├─ wallet_master_seed = XOF(seed || "ZHTP_WALLET_SEED_V1")
 └─ PQC keypairs (random, attached via pqcrypto-*)

Testing

All tests passing:

running 3 tests
test seed::tests::test_generate_identity_seed_produces_64_bytes ... ok
test seed::tests::test_generate_identity_seed_is_non_zero ... ok
test seed::tests::test_generate_identity_seed_produces_different_values ... ok

Related

• lib-identity issue #10 (P1-7 new_unified constructor)
• Enables deterministic identity recovery across devices
• Compatible with future seeded PQC libraries (liboqs-rust)