feat(identity): seed-derivation verifier + KAT; rename "Your DID"→"Node DID"

- scripts/verify-seed-derivation.py: stdlib-only tool to cryptographically prove
  a node's on-disk keys (node_key→DID, nostr_secret→npub, fips_key) are derived
  from its onboarding seed exactly as seed.rs documents (BIP-39 → PBKDF2-HMAC-
  SHA512 → HKDF-SHA256 with per-key domain separation).
- seed.rs: known-answer regression test cross-checking Rust node_key + nostr
  bytes against the Python verifier (locks the derivation).
- en.json: "Your DID" → "Node DID".

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core/archipelago/src/seed.rs

@@ -543,4 +543,22 @@ mod tests {
             }
         }
     }
+
+    #[test]
+    fn test_node_key_known_answer_vs_python_verifier() {
+        // Cross-checks scripts/verify-seed-derivation.py: same mnemonic must
+        // produce the same node_key bytes in Rust and in the Python verifier.
+        let (_, seed) = MasterSeed::from_mnemonic_words(TEST_MNEMONIC).unwrap();
+        let key = derive_node_ed25519(&seed).unwrap();
+        assert_eq!(
+            hex::encode(key.to_bytes()),
+            "3b4f4a1450450260ae360adb9c33ea5eb86356fa14454ca0067dd4b51ea8be87"
+        );
+        let nostr = derive_node_nostr_key(&seed).unwrap();
+        assert_eq!(
+            hex::encode(nostr.secret_key().to_secret_bytes()),
+            "3a94fb32efab2a5025401d53fd7d82b41323a5c06ad14ce528ebe3a813d88831"
+        );
+    }
+
 }