feat(backup): sealed backups + printable recovery sheet

'Save a backup' now writes a sealed .tanemaki file (AES-256-GCM under a
key HKDF-derived from the root seed; format TANEBK v1, open and stable).
Restoring on the same identity is silent; a copy sealed by another
identity asks for the printed recovery code (TANE1 base32, typo-tolerant)
and adopts that seed — recovering your bank recovers you. Legacy plain
exports still restore. Settings gains a recovery sheet (QR + code PDF).
BackupBox/RecoveryCode live in commons_core, pure Dart, TDD.

apps/app_seeds/lib/security/secure_key_store.dart

@@ -29,6 +29,12 @@ class SecureKeyStore {
   Future<String> rootSeedHex() =>
       _readOrCreate(rootSeedName, _identity.generateRootSeed);
 
+  /// Replaces the root seed with one recovered from a printed code (restoring
+  /// your bank on a new device recovers your identity too). The DB key is
+  /// untouched — it never leaves this device's keystore.
+  Future<void> adoptRootSeed(String seedHex) =>
+      _store.write(rootSeedName, seedHex);
+
   Future<String> _readOrCreate(
     String key,
     List<int> Function() generate,