feat: identity export/import (yaw-key-backup-1)

Portable encrypted identity backup compatible with the sister project's
format — argon2id KDF + nacl secretbox, peer ID visible in plaintext for
pre-import verification.

- crypto: ExportIdentity, ImportIdentity, SaveIdentity
- proto: export_identity / import_identity IPC commands + events
- ipc: export_identity returns encrypted blob; import_identity validates
  and decrypts (read-only — on-disk write requires daemon restart)
- netmgr: MasterIdentity() accessor
- daemon: --import-identity / --import-passphrase flags write identity.json
  and exit, enabling scripted account migration
- tests: roundtrip and wrong-passphrase rejection

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/netmgr/manager.go

@@ -234,6 +234,9 @@ func (mgr *Manager) All() []*Network {
 // AnchorURL returns the configured anchor URL.
 func (mgr *Manager) AnchorURL() string { return mgr.cfg.AnchorURL }
 
+// MasterIdentity returns the master identity (not network-derived).
+func (mgr *Manager) MasterIdentity() *crypto.Identity { return mgr.cfg.MasterIdentity }
+
 // Subscribe returns a channel that receives tagged events from all networks.
 func (mgr *Manager) Subscribe() <-chan proto.IpcMessage {
 	ch := make(chan proto.IpcMessage, 128)