Reinstalling the applet via `./gradlew install` wipes any existing
personalization regardless of firmware source, which wasn't previously
called out and is a common source of "card not available" confusion.
Also state plainly that personalization is required before any command
works, and document keycard-rs's actual baked-in default CA public key
instead of only describing the override mechanism.
Export KEYCARD_CA_PUBLIC_KEY in all keycard test scripts so they work
against the dev/test-CA personalization flow they rely on.
Rewrites the Keycard integration to talk to the LEE-flavored applet
directly from Rust via keycard-rs (pinned git dependency), dropping the
pyo3 shim, python_path.rs, and the vendored keycard-py Python library
entirely. Verified end-to-end against real hardware: pairing, PIN
verification, mnemonic loading, BIP340 Schnorr signing, and transfers
between keycard and public/private accounts.
Also cleans up the pyo3 usage that had leaked into wallet's signing
path (signing.rs, account_manager.rs) beyond the keycard CLI itself,
and trims wallet_with_keycard.sh's Python setup down to just pyscard,
which is only needed by the force_unpower.py test helper now.
BREAKING CHANGE: LEZ crates have been moved from top-level directories into
a dedicated `lez/` subdirectory. The following crates were relocated:
common → lez/common
indexer → lez/indexer
explorer_service→ lez/explorer_service
keycard_wallet → lez/keycard_wallet
mempool → lez/mempool
sequencer → lez/sequencer
storage → lez/storage
testnet_initial_state → lez/testnet_initial_state
wallet → lez/wallet
wallet-ffi → lez/wallet-ffi
Any external tooling, scripts, or paths referencing these crates at their
previous top-level locations must be updated.
