feat(alknet-secret): make DerivedKey zeroize-on-drop, non-Clone, with redacted serialization

Per ADR-038, DerivedKey.private_key now derives Zeroize with #[zeroize(drop)]
ensuring sensitive key material is zeroized before deallocation. DerivedKey
is now move-only (no Clone), and JSON/debug output redacts private_key as
"[REDACTED]". Deserialization still works for postcard/irpc wire format.

Also fixes clippy needless_borrows_for_generic_args in encryption.rs and
applies cargo fmt to existing code.

crates/alknet-secret/src/lib.rs

@@ -38,4 +38,4 @@ pub use derivation::{ExtendedPrivKey, PATHS};
 pub use encryption::{EncryptedData, EncryptionError};
 pub use mnemonic::{Language, Mnemonic, Seed};
 pub use protocol::{DerivedKey, KeyType, SecretMessage, SecretProtocol};
-pub use service::{SecretService, SecretServiceError, SecretServiceHandle};
+pub use service::{SecretService, SecretServiceError, SecretServiceHandle};