feat(shielded): ITZLI tagging — O(1) note discovery via Poseidon2 tag

Fixes Point 8 — private note discovery is O(n) trial-decrypt.

**ITZLI** — *Obsidian Mirror* tagging for Aleph Zero Common (Port of Aztec V5 to Frontier 1621):


- `ECDH(sk_s, pk_r) → k = KDF(shared, pk_r, pk_s)` → `tag = Poseidon2(k, counter)` 16-window
- `Mapping>` + `get_logs_by_tag` / `get_paginated` / `batch_get_logs` (PIR-ready)
- Caps `2048/64/1M` + `BTreeMap` determinism, no `Halo2 MerklePath` touch

**Bench 2026-08-31 live:**
- `itzli-node 18232` 100k: **5 ms tag vs 1000 ms legacy → 200×** (10k: 5 ms vs 100 ms → 20×)
- `e2e-demo` 10k in-mem: 14 µs, 10000× fewer decryptions
- WASM `7.3K` `ink!5.1` `code_hash 0x71806a…` `contract 5GheSZZSzcQEwsWuRKdt3xhy9d7QG5WysjMzb4QApVjXGob6` on `substrate-contracts-node 9945` (aleph-node 15.2.0 testnet has no pallet-contracts, 1:1 proxy)

**Repo:** https://github.com/benoirczar-ml/ITZLI
**Spec:** https://github.com/benoirczar-ml/ITZLI/blob/main/docs/03-spec-tag-derivation.md
**Benchmark:** https://github.com/benoirczar-ml/ITZLI/blob/main/docs/04-benchmark.md

**Contact:** Jaroslaw Kata (also `itzli@alephzero.common`) — applying as Common core dev for shielded pool. This repo is the PR. Not a fork.

Read docs/03-spec-tag-derivation.md and docs/04-benchmark.md in the linked ITZLI repository, then compare the proposed implementation with aleph-node. Run or review the benchmark results and verify that the requested tag-based discovery, log queries, stated caps, and deterministic BTreeMap behavior are integrated and tested in the target repository.

Written by the indexing model from the issue text.