Encrypted recovery kit export and restore

[truthixify]

Tier: M (2-4 days) | Type: feature

Context. Losing the wallet used to derive stealth keys today means losing scan access to all past deposits. The SDK exposes both viewing and spending scalars via deriveStealthKeys. Give users a passphrase-encrypted JSON kit they can back up offline and restore on a fresh browser to regain scanning.

Scope.

• Settings action "Export recovery kit" produces an AES-GCM encrypted JSON with viewing scalar, meta-address, chain, and profile labels.
• Passphrase entry with strength meter; kit filename includes the meta-address prefix.
• Restore flow accepts the kit and unlocks receive-only mode without needing the original wallet.
• Copy is explicit that the kit gives scan and, if the spending scalar is included, spend authority.

Acceptance.

• Kit round-trips: export then import on a fresh browser reveals the same activity
• Weak passphrases (<8 chars) blocked at export
• Restored session flags itself as "recovery mode" in the header
• Never writes the plaintext scalars to disk or storage

Files. src/lib/stellar/recoveryKit.ts (new), src/pages/Settings.tsx, src/vault/KeyVault.ts, src/context/StealthKeysContext.tsx.