feat(secret): add alknet-secret crate and architecture spec for Phase 3

Create the alknet-secret crate with BIP39 mnemonic generation, SLIP-0010
Ed25519 HD key derivation, AES-256-GCM encryption, and SecretProtocol
irpc service definition. This is Phase 3.1 from the integration plan.

Architecture changes:
- Promote secret-service.md to reviewed status with full spec format
  (crate structure, public API, security model, phase progression,
   ADR/OQ cross-references, wire format compatibility section)
- Add ADR-038 (seed lifecycle and memory security): zeroize for v1,
  mlock deferred to Phase B
- Add OQ-SEC-01 (mlock/VirtualLock for seed RAM) to open-questions.md
- Update README.md with ADR-038 and secret-service status

Crate structure:
- src/mnemonic.rs: BIP39 phrase generation, validation, seed derivation
- src/derivation.rs: SLIP-0010 HD key derivation, path constants (74')
- src/encryption.rs: AES-256-GCM encrypt/decrypt, EncryptedData type
- src/protocol.rs: SecretProtocol irpc enum, DerivedKey, KeyType
- src/service.rs: SecretServiceHandle with Unlock/Lock lifecycle
- 40 passing tests (unit + integration + doc)

crates/alknet-secret/src/lib.rs

@@ -0,0 +1,41 @@
+//! # alknet-secret
+//!
+//! BIP39 mnemonic generation, SLIP-0010 Ed25519 HD key derivation, AES-256-GCM
+//! encryption for external credentials, and the `SecretProtocol` irpc service.
+//!
+//! This crate is the only component that holds the master seed phrase. All other
+//! crates request derived keys through the `SecretProtocol` irpc service or the
+//! `SecretServiceHandle` local API.
+//!
+//! ## Crate Independence
+//!
+//! alknet-secret does **not** depend on alknet-core or alknet-storage. Per ADR-027,
+//! it is fully independent. The `EncryptedData` wire format is shared with
+//! alknet-storage by type-level compatibility, not a crate dependency.
+//!
+//! ## Security Model
+//!
+//! The seed phrase is never persisted to disk. It is entered at startup or via
+//! `Unlock` and held only in `Zeroize`-protected RAM (ADR-038). `Lock` purges
+//! the seed and all cached derived keys.
+//!
+//! ## Module Organization
+//!
+//! - [`mnemonic`] — BIP39 mnemonic generation, validation, and seed derivation
+//! - [`derivation`] — SLIP-0010 Ed25519 HD key derivation and path constants
+//! - [`encryption`] — AES-256-GCM encrypt/decrypt and `EncryptedData` type
+//! - [`protocol`] — `SecretProtocol` irpc service enum, `DerivedKey`, `KeyType`
+//! - [`service`] — `SecretService` implementation with Unlock/Lock lifecycle
+
+pub mod derivation;
+pub mod encryption;
+pub mod mnemonic;
+pub mod protocol;
+pub mod service;
+
+// Re-export primary public API
+pub use derivation::{ExtendedPrivKey, PATHS};
+pub use encryption::{EncryptedData, EncryptionError};
+pub use mnemonic::{Language, Mnemonic, Seed};
+pub use protocol::{DerivedKey, KeyType, SecretMessage, SecretProtocol};
+pub use service::{SecretService, SecretServiceError, SecretServiceHandle};