refactor(vault): remove derive_password and site_password_path (ADR-025)

Drop the password-manager pattern from alknet-vault (drift item #7,
ADR-025, resolves review #002 C9). Site-specific password derivation
is not relevant to an RPC system's vault.

Removed:
- derive_password method from VaultServiceHandle (service.rs)
- derive_password_string method from VaultServiceHandle (service.rs)
- site_password_path function from derivation.rs
- site-password derivation path row from derivation.rs doc table
- All password-derivation tests from service.rs and derivation.rs
- Now-unused base64 URL_SAFE_NO_PAD import from service.rs

crates/alknet-vault/src/derivation.rs

@@ -11,7 +11,6 @@
 //! | `m/74'/0'/0'/0'` | Primary identity keypair | Ed25519 (alknet auth) |
 //! | `m/74'/0'/0'/{n}'` | Worker/device identity | Ed25519 |
 //! | `m/74'/0'/1'/0'` | SSH host key | Ed25519 |
-//! | `m/74'/1'/0'/{hash}'` | Site-specific password | Deterministic |
 //! | `m/74'/2'/0'/0'` | Encryption key for external credentials | AES-256-GCM |
 //! | `m/44'/60'/0'/0/0` | Ethereum signing key | secp256k1 |
 
@@ -52,13 +51,6 @@ pub fn device_path(index: u32) -> String {
     format!("m/74'/0'/0'/{}'", index)
 }
 
-/// Construct a site-specific password derivation path with the given hash.
-///
-/// Path: `m/74'/1'/0'/{hash}'`
-pub fn site_password_path(site_hash: &str) -> String {
-    format!("m/74'/1'/0'/{}'", site_hash)
-}
-
 /// A derived extended private key with its public key.
 ///
 /// Contains the private key bytes and public key bytes from
@@ -248,11 +240,6 @@ mod tests {
         assert_eq!(device_path(1), "m/74'/0'/0'/1'");
     }
 
-    #[test]
-    fn test_site_password_path() {
-        assert_eq!(site_password_path("abc123"), "m/74'/1'/0'/abc123'");
-    }
-
     #[test]
     fn test_derive_master_key_from_seed() {
         // Use a known 64-byte seed