refactor(wallet-cli): Wrap daemon password/SRP in opaque Password/Srp types

[sirtimid]

Summary

• Introduce `Password` and `Srp` opaque class wrappers in `packages/wallet-cli/src/daemon/secrets.ts`. Both redact themselves under `util.inspect`, `JSON.stringify`, `toString`, and template-literal interpolation; the raw string is reachable only via `unwrap()`.
• Thread the new types through `DaemonSpawnConfig`, `daemon start` flag parsing, `MM_WALLET_PASSWORD` / `MM_WALLET_SRP` env reads in `daemon-entry`, and `createWallet`. `unwrap()` is called only at trust boundaries.
• `Srp.from` validates word count (12/15/18/21/24), every word against the BIP-39 English wordlist, and the BIP-39 checksum via `validateMnemonic`, so typos fail fast at the CLI boundary. Input whitespace is normalized (trimmed and collapsed) so copy-pasted phrases with accidental spaces are accepted.
• `Password.from` matches the `@metamask/keyring-controller` convention: non-empty only.
• `@metamask/wallet`'s `importSecretRecoveryPhrase` signature stays on `string` — branding is scoped to wallet-cli.

Closes #8778.

Test plan

• `yarn workspace @metamask/wallet-cli run test` — 100% coverage on all touched files
• `secrets.test.ts` covers validation (word count, wordlist, checksum), whitespace normalization, redaction, and unwrap round-trip
• All test fixtures updated to use the standard BIP-39 test vector (`abandon` × 11 + `about`) instead of the fake non-checksummed phrase

🤖 Generated with Claude Code

---

Note

Medium Risk
Touches wallet password and SRP handling at daemon startup and spawn; changes are defensive (redaction, earlier env scrub, stricter SRP validation) but incorrect validation could block legitimate mnemonics or affect startup paths.

Overview
Introduces opaque Password and Srp wrappers in secrets.ts so secrets show as [redacted] in logs, JSON.stringify, and util.inspect, with raw values exposed only via unwrap() at trust boundaries (child-process env, importSecretRecoveryPhrase).

Those types replace plain strings through daemon start, ensureDaemon, daemon-entry, and createWallet. Srp.from validates BIP-39 word count, English wordlist, and checksum (via @metamask/scure-bip39); Password.from requires a non-empty string.

daemon-entry now deletes MM_WALLET_PASSWORD / MM_WALLET_SRP from the environment before wrapping/validation so a bad mnemonic does not leave raw secrets in the long-lived daemon’s env. Tests and fixtures switch to the standard abandon×11 + about mnemonic.

^{Reviewed by Cursor Bugbot for commit ef98685. Bugbot is set up for automated code reviews on this repo. Configure here.}

[rekmarks]

Approved with one nit

[rekmarks]

nit:

Suggested change

	const normalized = words.join(' ');
	for (const word of words) {
	if (!WORDLIST_SET.has(word)) {
	throw new Error(
	'Secret recovery phrase contains a word not in the BIP-39 English wordlist',
	);
	}
	}
	if (!validateMnemonic(normalized, wordlist)) {
	throw new Error('Secret recovery phrase has an invalid checksum');
	}
	for (const word of words) {
	if (!WORDLIST_SET.has(word)) {
	throw new Error(
	'Secret recovery phrase contains a word not in the BIP-39 English wordlist',
	);
	}
	}
	const normalized = words.join(' ');
	if (!validateMnemonic(normalized, wordlist)) {
	throw new Error('Secret recovery phrase has an invalid checksum');
	}

[sirtimid]

Done ef98685