docs(architecture): remove derive_password and site_password_path from vault

The password-manager pattern (deterministic per-site passwords from HD
derivation) is not relevant to an RPC system's vault. Handlers call APIs
(using API keys, OAuth tokens, mTLS), not websites with passwords. The
vault is for cryptographic key derivation and credential encryption.

Removes:
- derive_password, derive_password_string from service.md
- site_password_path from mnemonic-derivation.md
- m/74'/1'/0'/{hash}' path from PATHS module and path semantics table
- derive_password row from the cache table

Resolves review #002 C9 (site_password_path hash mapping underspecified)
by removing the feature rather than specifying the non-standard
string→u32 mapping and Ed25519-as-password-entropy construction.

If deterministic password generation is ever needed (browser-automation
edge case), it can be re-added — the cost is near-zero. Removing it now
eliminates permanent API surface inherited from a prior project's
password-manager pattern.

docs/architecture/crates/vault/service.md

@@ -156,23 +156,6 @@ Derive a secp256k1 keypair at the given BIP-0032 path. Returns
 `UnsupportedKeyType` when the `secp256k1` feature is disabled. Returns a
 `DerivedKey` with `KeyType::Secp256k1` (33-byte compressed public key).
 
-### derive_password(path, length) → Vec<u8>
-
-```rust
-pub fn derive_password(&self, path: &str, length: usize) -> Result<Vec<u8>, VaultServiceError>;
-pub fn derive_password_string(&self, path: &str, length: usize) -> Result<String, VaultServiceError>;
-```
-
-Derive deterministic password bytes at the given path, truncated to
-`length`. This is **not cached** — password derivation is cheap and
-passwords are typically one-shot (derive, use, discard). The string
-variant base64url-encodes the bytes (URL-safe, no padding).
-
-`derive_password` is the mechanism for per-site deterministic passwords:
-the same seed + path always produces the same password. The path includes
-a site hash (`site_password_path(site_hash)`) so different sites get
-different passwords.
-
 ## Encrypt and Decrypt
 
 ### encrypt(plaintext, key_version) → EncryptedData
@@ -250,13 +233,8 @@ pub struct CacheConfig {
 | `derive_ed25519` | Yes | Derivation is expensive; keys are reused |
 | `derive_encryption_key` | Yes | Same — encryption key reused across calls |
 | `derive_ethereum_key` | Yes | Same |
-| `derive_password` | No | Cheap derivation; passwords are one-shot |
 | `encrypt` / `decrypt` | Key cached | The encryption key (at `PATHS::ENCRYPTION`) is cached; the plaintext is not |
 
-`derive_password` does not cache because it's a truncation of derived
-bytes, not a keypair that's reused. Caching it would grow the cache with
-unique paths (one per site hash) for no reuse benefit.
-
 ## Dispatch
 
 The vault uses **direct method calls** on `VaultServiceHandle` — no actor,
@@ -316,7 +294,7 @@ alknet-core error types at the assembly boundary (ADR-018).
 | RwLock for thread safety | — | Multiple readers (derive), exclusive writer (unlock/lock) |
 | TTL + LRU cache | — | Bounded memory, fresh keys, zeroized eviction |
 | Direct method calls (no actor) | [ADR-025](../../decisions/025-vault-local-only-dispatch.md) | No irpc, no message enum, no remote dispatch capability |
-| `derive_password` not cached | — | One-shot; caching grows cache with no reuse |
+| `derive_password` removed | [ADR-025](../../decisions/025-vault-local-only-dispatch.md) | Password-manager pattern not relevant to RPC system's vault; resolves C9 |
 
 ## Open Questions