feat: add VerifyDER, test vector generator, and snap planning docs

[salindne]

Summary

Phase 1 of the MetaMask Snap non-custodial signing effort (see docs/non-custodial-snap-plan.md):

• VerifyDER (pkg/keys/canton_keys.go) — Server-side verification of DER-encoded ECDSA signatures against a compressed public key and pre-hashed digest. Validates DER structure, low-S normalization, and signature correctness. Needed by the transfer execute endpoint to validate client-provided signatures before forwarding to Canton.
• cmd/generate-test-vectors — Generates deterministic crypto test vectors (SPKI DER, fingerprints, DER signatures) from hardcoded private keys. Output is a JSON file for cross-validation with the canton-snap TypeScript implementation. Run via make test-vectors.
• Planning docs — docs/non-custodial-snap-plan.md (full hybrid architecture plan) and docs/phase1-crypto-compatibility.md (detailed Phase 1 task breakdown).

Test plan

• TestVerifyDER — valid sig, wrong hash, wrong pubkey, malformed DER, wrong hash length, trailing bytes
• TestVerifyDERWithKnownVector — deterministic key produces verifiable signature
• cmd/generate-test-vectors self-verifies all generated signatures via VerifyDER
• make lint passes
• go test ./pkg/keys/ passes

[gemini-code-assist]

Code Review

This pull request introduces a comprehensive implementation plan for non-custodial signing via MetaMask Snaps, alongside a new utility for generating deterministic crypto test vectors to ensure cross-platform compatibility with TypeScript. The changes also include the addition of a VerifyDER function in the keys package to validate DER-encoded ECDSA signatures. Review feedback suggests improving the VerifyDER implementation by using standard library constants for the secp256k1 curve order and adopting more efficient, idiomatic signature verification methods instead of public key recovery.

[gemini-code-assist]

Instead of hardcoding the secp256k1 curve order as a string, use the constant provided by the crypto package. This improves maintainability and reduces the risk of typos.

Suggested change

	secp256k1N, _ := new(big.Int).SetString("fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141", 16)
	secp256k1N := crypto.S256().Params().N

[gemini-code-assist]

Using a recovery loop (SigToPub) to verify a signature when the public key is already known is inefficient. It is more idiomatic and performant to use crypto.VerifySignature directly. Additionally, comparing public keys directly is more robust than comparing their Ethereum addresses, as it avoids the overhead of hashing and the theoretical (though negligible) risk of collisions.

	// Verify the signature against the public key
	if !crypto.VerifySignature(crypto.FromECDSAPub(pubKey), hash, rawSig) {
		return fmt.Errorf("signature verification failed")
	}

	return nil