phase 1: full read path — bip39 + cip-3 + cip-1852 + koios + age-mnemonic + rmcp

end-to-end working wallet: paste 24-word mnemonic, age-encrypt at rest,
on unlock derive root + payment + stake keys, build cip-19 base address,
serve four tools over mcp stdio (wallet.address, wallet.network,
wallet.balance, wallet.utxos).

deps added: ed25519-bip32 0.4 (pallas only ships raw ed25519, not the
cardano variant of bip32 hd derivation), cryptoxide 0.4 for pbkdf2-hmac-sha512,
age 0.10 for at-rest mnemonic encryption, rpassword 7 for tty-only passphrase
prompts, toml 0.9 for config.toml.

new modules:
- crates/aldabra-core/src/derive.rs — payment + stake key derivation, hash
- crates/aldabra-chain/src/koios.rs — real reqwest impl, asset aggregation
- crates/aldabra-mcp/src/{bootstrap,config,tools}.rs

caught one bug pre-flight: get_balance was clobbering same-asset
quantities across utxos instead of summing. fixed + regression test.

headless support via ALDABRA_PASSPHRASE env (mcp clients own stdin so
the rpassword prompt path can't run). docker secret / systemd
EnvironmentFile sources it in production.

dockerfile: multi-stage rust:1.95-bookworm → debian:bookworm-slim, tini
as pid1, non-root aldabra user, /var/lib/aldabra owned 700.

29 unit tests + 1 ignored live-koios test. preprod smoke test exercised
initialize → tools/list → tools/call wallet.address end-to-end via
piped json-rpc; correct preprod address came back from canonical
abandon-art mnemonic.

phase 2 (send) is next.

Cargo.toml

@@ -41,9 +41,18 @@ pallas-addresses = "0.32"
 pallas-txbuilder = "0.32"
 pallas-network = "0.32"
 
-# Mnemonic + key derivation. bip39 for the wordlist, then pallas-crypto
-# handles the Cardano-specific CIP-3 / CIP-1852 derivation paths.
+# Mnemonic + key derivation.
+#  bip39 — 24-word wordlist parsing + BIP-39 entropy extraction.
+#  ed25519-bip32 — Cardano's variant of BIP-32-Ed25519 HD derivation
+#                  (XPrv + DerivationScheme::V2 hard/soft children).
+#                  pallas-crypto only ships raw ed25519, not HD derivation.
+#  cryptoxide — PBKDF2-HMAC-SHA512 for Icarus master-key generation
+#               (CIP-3). Already pulled in transitively by
+#               ed25519-bip32; declared here so we can use pbkdf2 + Sha512
+#               directly in aldabra-core.
 bip39 = "2"
+ed25519-bip32 = "0.4"
+cryptoxide = "0.4"
 
 # At-rest encryption for the mnemonic + derived keys on disk. age is
 # what the cauldron Fernet pattern would have been if we'd had it back
@@ -73,3 +82,10 @@ rmcp = { version = "0.1", features = ["server", "transport-io"] }
 # Logging
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+
+# Config file parsing — TOML at $ALDABRA_DATA/config.toml.
+toml = "0.9"
+
+# Hidden-input passphrase prompts for the mnemonic bootstrap CLI.
+# rpassword is the standard "tty echo off" prompt crate.
+rpassword = "7"