fix(wasm): zeroize transient device-private-key copy in export_state_bytes

Review fix (Important secret-hygiene finding): export_state_bytes built a
PersistedDeviceState via state.signing_private.as_str().to_owned(), creating
non-zeroized heap copies of the device ed25519 private keys (signing + deploy)
that lingered as plaintext residue after the struct dropped.

- Cargo.toml: enable zeroize "derive" feature (zeroize_derive already in lock tree)
- device.rs: PersistedDeviceState now derives Zeroize + ZeroizeOnDrop, wiping all
  String fields on every drop path (success, serde_json::to_vec ? error path, panic)
- device.rs: import_state_bytes uses std::mem::take per field (ZeroizeOnDrop adds a
  Drop impl, so fields can no longer be moved out — E0509); mem::take transfers the
  heap buffers without copying, leaving empty Strings the drop-zeroize no-ops
- doc-comments updated to describe the ZeroizeOnDrop / mem::take hygiene

Hygiene-only; no behavior change. Gates: cargo test -p relicario-wasm 15/15,
clippy -D warnings clean, build --target wasm32-unknown-unknown clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014s527M917W47LDrfQ4t47g

crates/relicario-wasm/Cargo.toml

@@ -14,7 +14,7 @@ wasm-bindgen = "0.2"
 serde-wasm-bindgen = "0.6"
 serde_json = "1"
 serde = { version = "1", features = ["derive"] }
-zeroize = "1"
+zeroize = { version = "1", features = ["derive"] }
 getrandom = { version = "0.2", features = ["js"] }
 ed25519-dalek = { version = "2", features = ["rand_core"] }
 base64 = "0.22"