wallet: rebase CWalletDB onto CWalletBatchTyped (SQLite default)

Move CWalletDB off the Berkeley CDB base class and onto the typed batch
seam introduced by walletdb-batch.h / walletdb-{factory,sqlite}.{h,cpp}.

Build seam
----------
* CWalletDB now derives from CWalletBatchTyped. The typed Read/Write/
  Erase/Exists templates come from the seam; their bodies (WriteTx,
  WriteKey, WriteMasterKey, ReadPool, WriteSetting, ...) are unchanged
  because only the base class swapped — the call signatures resolve to
  the same templates.
* CWalletBatchTyped takes ownership of the WalletDatabase so the
  underlying connection outlives any batch issued by it (SQLiteBatch
  holds a reference, not a value). The two-phase Open() pattern lets
  CWalletDB hand the freshly opened database to the base class after
  MakeWalletDatabase() returns.
* MakeWalletDatabase (walletdb-factory.cpp) routes -walletdb=sqlite to
  SQLiteDatabase, returning nullptr with a clear error for the
  unfinished Berkeley branch. The CWalletDB constructor surfaces that
  error string on failure.

Cursor sites (the only Berkeley-specific call sites)
---------------------------------------------------
Three sites used GetCursor()/ReadAtCursor() directly:
  * LoadWallet       — full scan, now uses StartCursor()/NextRecord()
  * ListAccountCreditDebit — used DB_SET_RANGE + DB_NEXT loop; replaced
    with full keyspace scan + filter-in-loop (SQLite cursor does not
    support keyed range seeks). Behaviour matches Berkeley: terminates
    when strType changes or, in single-account mode, when
    acentry.strAccount differs.
  * ZapWalletTx — moved to BerkeleyZapWalletTx (see below) because it
    operates on raw Berkeley Db/Dbc/Dbt now that CWalletDB is on the
    seam.

The 3 unused public methods on the old CWalletDB (GetAtCursor /
GetTxnCursor / GetAtActiveTxn) had no callers outside walletdb.{h,cpp}
(verified by grep) and were removed.

Berkeley-only escape hatches
----------------------------
Recover(CDBEnv&,...) and ZapWalletTx(...) became BerkeleyRecoverWallet
and BerkeleyZapWalletTx in a new walletdb-recover.{h,cpp} pair. They
operate directly on DbEnv/Db/Dbc/Dbt because CDB's members are
protected (free functions cannot use the wrapper). The recovery logic
duplicates a BDB-only ReadKeyValue variant locally to avoid pulling
the typed batch seam into a Berkeley-only file.

Init.cpp uses these via:
  * -salvagewallet   -> BerkeleyRecoverWallet(bitdb, ..., fOnlyKeys=true)
  * -zapwallettxes   -> BerkeleyZapWalletTx(...)
  * bitdb.Verify     -> BerkeleyRecoverWallet as the recover callback

Wallet migration hook
---------------------
After the Berkeley verify/salvage/zap steps and before CWalletDB is
opened for the live wallet, init.cpp now calls:

    if (ResolveWalletDbKind() == SQLite &&
        !IsSQLiteFile(walletPath))
        MaybeMigrateBerkeleyWalletToSQLite(walletPath, err)

The migration code (walletmigrate.{h,cpp}) is unchanged — it opens a
private Berkeley environment over the wallet directory, copies every
record verbatim (raw key/value bytes) into a fresh SQLite file,
verifies the row count, then atomically renames the BDB original to
"<name>.bdb.bak" and the SQLite file into place. On any failure the
BDB original is left exactly as it was. Errors surface through
InitError so the daemon refuses to start with a corrupt wallet rather
than silently falling back to Berkeley.

No working Berkeley fallback
----------------------------
MakeWalletDatabase returns nullptr for the Berkeley branch, so
-walletdb=bdb no longer opens a working wallet through the seam. This
is intentional for this release — the migration hook handles existing
BDB wallets at first startup, after which the on-disk file is SQLite
and the BDB code path becomes pure recovery glue.

Header fallout
--------------
walletdb.h no longer pulls in db.h (which would drag <db_cxx.h> into
every TU that includes the wallet API). Forward decls added for
CWalletTx, CBlockLocator, CWallet, CPubKey, CScript, CMasterKey,
uint160, uint256. nWalletDBUpdated is now extern-declared in
walletdb.h and defined in db.cpp (was previously declared in db.h).

Validation
----------
Build: GREEN with USE_TOR_EMBEDDED=ON USE_I2P_EMBEDDED=ON. 6 binaries:
trianglesd, triangles-cli, test_triangles, test_chaindb_runtime,
test_chaindb_equivalence, test_snapshotnet.

Tests: 107/107 + 10/10 + 5/5 = byte-identical to the 5d9da84
baseline. wallet_tests and accounting_tests inside test_triangles now
exercise the SQLite path for the first time — their pass is the
de-facto wallet-migration validation at the test-suite level.

src/walletdb-batch.h

@@ -30,12 +30,33 @@
 class CWalletBatchTyped
 {
 public:
-    explicit CWalletBatchTyped(std::unique_ptr<WalletBatch> batch)
-        : m_batch(std::move(batch)) {}
-
+    // Default-constructed handle is unusable until Open() runs. Subclasses
+    // (CWalletDB) call Open() once they have opened a WalletDatabase.
+    CWalletBatchTyped() = default;
     virtual ~CWalletBatchTyped() { Close(); }
 
-    void Close() { m_batch.reset(); }
+    // Open a fresh batch against the given database. Closes any previously
+    // open batch+database. Returns false (and leaves the handle null) if the
+    // database fails to produce a batch.
+    bool Open(std::unique_ptr<WalletDatabase> db)
+    {
+        Close();
+        if (!db)
+            return false;
+        m_database = std::move(db);
+        m_batch = m_database->MakeBatch(/*flush_on_close=*/true);
+        if (!m_batch) {
+            m_database.reset();
+            return false;
+        }
+        return true;
+    }
+
+    void Close()
+    {
+        m_batch.reset();
+        m_database.reset();
+    }
     bool IsNull() const { return m_batch == nullptr; }
 
     // ── Transactions ─────────────────────────────────────────────────────────
@@ -44,6 +65,7 @@ public:
     bool TxnAbort()  { return m_batch && m_batch->TxnAbort(); }
 
 protected:
+    std::unique_ptr<WalletDatabase> m_database;
     std::unique_ptr<WalletBatch> m_batch;
 
     // ── Typed accessors (serialize key/value, dispatch to the raw batch) ──────