document the wallet key custody model

covers both encryption layers, what each one does and does not protect
against, the watch-only-while-locked property and the unlock session
rules. records the known limits: the heap cannot be reliably wiped, the
storage key is derived with a plain sha-256 rather than a kdf, and
rotating VAULT_STORE_KEY has no migration path.

also corrects the changePassphrase doc comment, which claimed rotation
never touches the dek. it mints a fresh salt, dek and ivs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/sidecar/wallet/keys.ts

@@ -366,7 +366,11 @@ export async function exportMnemonic(env: SeedEnvelope, ownerPassphrase: string)
   return opened.mnemonic;
 }
 
-/** Re-wrap an existing seed under a new passphrase. Requires the old one; never touches the DEK. */
+/**
+ * Re-seal an existing seed under a new passphrase. Requires the old one. Note this mints a FRESH salt,
+ * DEK and IVs rather than merely re-wrapping the existing DEK — so a copy of the old envelope, plus the
+ * old passphrase, cannot decrypt anything written after a rotation.
+ */
 export async function changePassphrase(
   env: SeedEnvelope,
   oldPassphrase: string,