[`MetamaskController` B.3] Scaffold and port `hardware-wallet` module

**Sub-epic:** [#41737 — `MetamaskController` decomposition: extension-specific modules](https://github.com/MetaMask/metamask-extension/issues/41737)
**Files:**
- `app/scripts/lib/hardware-wallet/index.ts` (new)
- `app/scripts/lib/hardware-wallet/hardware-wallet.test.ts` (new)
- `app/scripts/metamask-controller.js`

**Size:** M

## Problem

Hardware wallet transport lifecycle lives inline on `MetamaskController`: Ledger / Trezor / Lattice USB and WebHID transport setup, unlock flows, and the ~11 supporting methods. Extract them into `hardware-wallet/` so the responsibility is named and independently testable. This module lives under `app/scripts/lib/` (not `wallet-services/`) because its transport dependencies are browser-specific.

## Solution

1. Create `app/scripts/lib/hardware-wallet/` with `index.ts` exporting the `HardwareWalletManager` class.
2. Port the hardware-wallet methods from `metamask-controller.js` into the class.
3. Inject transport deps via the constructor (not imported at module top level) so the module stays testable.
4. Add unit tests stubbing transports.
5. Delete the moved method bodies from `metamask-controller.js`.
6. Update `MetamaskController#getApi()` forwards where applicable.

## Acceptance criteria

- [ ] `app/scripts/lib/hardware-wallet/index.ts` exists with the full set of hardware-wallet methods fully bodied
- [ ] Unit tests pass with stubbed transports
- [ ] Module lives in the extension-specific layer (not `wallet-services/`)
- [ ] Moved method bodies removed from `app/scripts/metamask-controller.js`
- [ ] `getApi()` entries rewritten to call `messenger.call('Module:action', ...)` directly — no forwarding stub remains in `MetamaskController`
- [ ] `yarn test` green, `tsc` green, extension dev build boots

## Dependencies

None.

Start by reading the hardware-wallet methods in app/scripts/metamask-controller.js and the requested entry points in app/scripts/lib/hardware-wallet/index.ts and hardware-wallet.test.ts. Use the existing controller methods and acceptance criteria as the scope, then run the unit tests, yarn test, tsc, and the extension dev build; done means the module is independently tested, controller bodies are removed, and getApi() has no forwarding stubs.

Written by the indexing model from the issue text.