Allow clients to use the profile's data-encryption key as the biometric login credential instead
of the raw password:
- LoginAccount: new `dek` request field (32 hex bytes, validated and normalized to lowercase,
mutually exclusive with password/mnemonic/keycard keys)
- resolveProfileSecret: accepts the client-hashed DEK ("0x" + keccak256), so a stored DEK
credential works through the existing hashed-password paths on the client side
- New ExportProfileDEK endpoint: returns the DEK for a valid credential