feat(programs): add Associated Token Account program with wallet CLI and tutorial

Introduce the ATA program, which derives deterministic per-token holding
accounts from (owner, token_definition) via SHA256, eliminating the need
to manually create and track holding account IDs.

Program (programs/associated_token_account/):
- Create, Transfer, and Burn instructions with PDA-based authorization
- Deterministic address derivation: SHA256(owner || definition) → seed → AccountId
- Idempotent Create (no-op if ATA already exists)

Wallet CLI (`wallet ata`):
- `address` — derive ATA address locally (no network call)
- `create`  — initialize an ATA on-chain
- `send`    — transfer tokens from owner's ATA to a recipient
- `burn`    — burn tokens from owner's ATA
- `list`    — query ATAs across multiple token definitions

Usage:
  wallet deploy-program artifacts/program_methods/associated_token_account.bin
  wallet ata address --owner <ID> --token-definition <DEF_ID>
  wallet ata create --owner Public/<ID> --token-definition <DEF_ID>
  wallet ata send --from Public/<ID> --token-definition <DEF_ID> --to <RECIPIENT> --amount 100
  wallet ata burn --holder Public/<ID> --token-definition <DEF_ID> --amount 50
  wallet ata list --owner <ID> --token-definition <DEF1> <DEF2>

Includes tutorial: docs/LEZ testnet v0.1 tutorials/associated-token-accounts.md

program_methods/guest/Cargo.toml

@@ -13,5 +13,7 @@ token_core.workspace = true
 token_program.workspace = true
 amm_core.workspace = true
 amm_program.workspace = true
+ata_core.workspace = true
+ata_program.workspace = true
 risc0-zkvm.workspace = true
 serde = { workspace = true, default-features = false }

program_methods/guest/src/bin/associated_token_account.rs

@@ -0,0 +1,65 @@
+use ata_core::Instruction;
+use nssa_core::program::{ProgramInput, read_nssa_inputs, write_nssa_outputs_with_chained_call};
+
+fn main() {
+    let (
+        ProgramInput {
+            pre_states,
+            instruction,
+        },
+        instruction_words,
+    ) = read_nssa_inputs::<Instruction>();
+
+    let pre_states_clone = pre_states.clone();
+
+    let (post_states, chained_calls) = match instruction {
+        Instruction::Create { ata_program_id } => {
+            let [owner, token_definition, ata_account] = pre_states
+                .try_into()
+                .expect("Create instruction requires exactly three accounts");
+            ata_program::create::create_associated_token_account(
+                owner,
+                token_definition,
+                ata_account,
+                ata_program_id,
+            )
+        }
+        Instruction::Transfer {
+            ata_program_id,
+            amount,
+        } => {
+            let [owner, sender_ata, recipient] = pre_states
+                .try_into()
+                .expect("Transfer instruction requires exactly three accounts");
+            ata_program::transfer::transfer_from_associated_token_account(
+                owner,
+                sender_ata,
+                recipient,
+                ata_program_id,
+                amount,
+            )
+        }
+        Instruction::Burn {
+            ata_program_id,
+            amount,
+        } => {
+            let [owner, holder_ata, token_definition] = pre_states
+                .try_into()
+                .expect("Burn instruction requires exactly three accounts");
+            ata_program::burn::burn_from_associated_token_account(
+                owner,
+                holder_ata,
+                token_definition,
+                ata_program_id,
+                amount,
+            )
+        }
+    };
+
+    write_nssa_outputs_with_chained_call(
+        instruction_words,
+        pre_states_clone,
+        post_states,
+        chained_calls,
+    );
+}