Port alknet-vault crate from alknet

Copy the local key vault (src/, tests/) verbatim from
alknet/crates/alknet-vault and create a standalone Cargo.toml
(workspace-inherited fields inlined). Port the architecture docs
(specs, ADRs 018-026, OQs 020-022) from alknet's nested multi-crate
layout to a flat single-crate layout, fixing relative link paths.

ADR and OQ numbers are preserved from alknet; a subsequent pass will
renumber them to a per-project sequence (001, 002, ...) and rebrand
alknet-vault -> alkvault (crate name, lib name, prose), updating the
cross-references to non-vault alknet ADRs (003, 005, 008, 010, 014,
064) that are referenced in the copied docs but not copied over.

Build, 108 tests, and clippy all pass clean.

tests/derivation_tests.rs

@@ -0,0 +1,57 @@
+//! Integration tests for key derivation.
+//!
+//! These tests verify that SLIP-0010 derivation produces correct results
+//! against known test vectors and that path constants produce expected key types.
+
+use alknet_vault::derivation::PATHS;
+use alknet_vault::service::VaultServiceHandle;
+
+#[test]
+fn test_identity_key_derivation() {
+    let service = VaultServiceHandle::new();
+    let _phrase = service.unlock_new(24).unwrap();
+
+    let key = service.derive_ed25519(PATHS::IDENTITY).unwrap();
+    assert_eq!(key.key_type, alknet_vault::protocol::KeyType::Ed25519);
+    assert!(!key.private_key.is_empty());
+    assert!(!key.public_key.is_empty());
+}
+
+#[test]
+fn test_encryption_key_derivation() {
+    let service = VaultServiceHandle::new();
+    service.unlock_new(24).unwrap();
+
+    let key = service.derive_encryption_key(PATHS::ENCRYPTION).unwrap();
+    assert_eq!(key.key_type, alknet_vault::protocol::KeyType::Aes256Gcm);
+}
+
+#[test]
+fn test_deterministic_derivation() {
+    // Same seed + same path = same key
+    let service = VaultServiceHandle::new();
+    let phrase = service.unlock_new(24).unwrap();
+
+    let key1 = service.derive_ed25519(PATHS::IDENTITY).unwrap();
+
+    // Unlock with the same phrase again
+    service.lock();
+    service.unlock(&phrase, None).unwrap();
+
+    let key2 = service.derive_ed25519(PATHS::IDENTITY).unwrap();
+
+    assert_eq!(key1.private_key, key2.private_key);
+    assert_eq!(key1.public_key, key2.public_key);
+}
+
+#[test]
+fn test_different_paths_different_keys() {
+    let service = VaultServiceHandle::new();
+    service.unlock_new(24).unwrap();
+
+    let identity_key = service.derive_ed25519(PATHS::IDENTITY).unwrap();
+    let ssh_key = service.derive_ed25519(PATHS::SSH_HOST).unwrap();
+
+    assert_ne!(identity_key.private_key, ssh_key.private_key);
+    assert_ne!(identity_key.public_key, ssh_key.public_key);
+}