feat(backup): sealed backups + printable recovery sheet

'Save a backup' now writes a sealed .tanemaki file (AES-256-GCM under a
key HKDF-derived from the root seed; format TANEBK v1, open and stable).
Restoring on the same identity is silent; a copy sealed by another
identity asks for the printed recovery code (TANE1 base32, typo-tolerant)
and adopts that seed — recovering your bank recovers you. Legacy plain
exports still restore. Settings gains a recovery sheet (QR + code PDF).
BackupBox/RecoveryCode live in commons_core, pure Dart, TDD.

packages/commons_core/pubspec.yaml

@@ -15,6 +15,8 @@ dependencies:
   uuid: ^4.5.0
   equatable: ^2.0.5
   meta: ^1.15.0
+  # Pure-Dart AEAD + HKDF (Apache-2.0) for sealed backups. No FFI, host-testable.
+  cryptography: ^2.7.0
 
 dev_dependencies:
   lints: ^6.0.0