feat(lnd): capture aezeed at wallet init + encrypted backup + reveal UI

- aezeed words are now captured at BOTH wallet-init paths and stored
  encrypted (Argon2 + ChaCha20-Poly1305, per-node wallet secret) at
  identity/lnd_aezeed.enc; ack marker cleared when a wallet is recreated
- lnd.init-wallet-from-seed was posting seed_entropy to /v1/initwallet,
  which is a GenSeed field — the wallet was never actually derived from
  the master seed; now GenSeed(entropy) → InitWallet(words)
- new RPCs: lnd.seed-backup-status / lnd.seed-reveal (password + 2FA
  gated, same as seed.reveal via shared verify_reveal_auth) /
  lnd.seed-backup-ack
- LND app detail page: Lightning-seed card with first-launch backup
  prompt, tap-to-reveal modal, 'I've backed it up' acknowledgment

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/api/rpc/middleware.rs

@@ -92,6 +92,8 @@ pub(super) fn sanitize_error_message(msg: &str) -> String {
         // "Operation failed. Check server logs." (which isn't even a crash).
         "Incorrect",
         "This node has no encrypted seed",
+        "No Lightning seed backup",
+        "Could not decrypt the saved Lightning seed",
         "A 2FA code is required",
         "2FA is enabled but",
         "Could not decrypt the saved seed",
@@ -136,6 +138,8 @@ mod sanitize_tests {
             "Could not decrypt the saved seed. If you set a separate backup passphrase during setup, enter that passphrase.",
             "Could not unlock 2FA with this password",
             "No mnemonic available. Generate or restore a seed first.",
+            "No Lightning seed backup exists on this node. It is captured automatically when the Lightning wallet is first created.",
+            "Could not decrypt the saved Lightning seed backup",
             "Submitted words do not match generated seed",
             "Already set up. Use auth.changePassword to change.",
         ] {