Add Confidential Note Fungible Token family

🧐 Motivation

No token in the library hides the full transaction graph. ConfidentialFungibleToken hides amounts but keeps the account graph public. The native shielded token (#544) gets transfer privacy from Zswap but publishes every mint and burn amount as a public supply delta. A regulated confidential asset needs all three hidden at once — amounts (including issuance and burns), sender, and recipient — plus auditor visibility and seizure.

Only a note (UTXO) model can deliver that. Sender privacy on an account model has no cheap trick: a debit writes to some public per-account slot, and hiding which slot needs either touch-all-N cover traffic (loses on cost) or an unindexed commitment set with in-circuit membership proofs and nullifiers. The latter is the note model.

📝 Details

Umbrella for the ConfidentialNoteFungibleToken family. Value lives as notes — (value, nonce) owned by pk = Hf(sk) — represented on the public ledger only by a hiding commitment cm = H(domain, value, nonce, pk) in a Merkle tree. Spending publishes nf = H(domain, nonce) and proves membership without revealing which leaf.

Three design moves carry the family:

• Audit-derived nonces — every output nonce comes out of the audit ECDH, so an output the auditor cannot open cannot exist. Auditor completeness is structural, not policy.
• Shared nullifiers — the nullifier preimage is the nonce alone, no owner secret. Owner-spend and seizure race on the same nullifier: escrow-free clawback, and the authority never holds spend keys.
• Supply as a policy layer — the core writes no public supply. A deployment picks none, confidential + attested, or public.

Shipped as composable pieces (core, role gates, compliance extensions, supply variants, presets) rather than a monolith. Each piece is a sub-issue of this one.

Draft implementation: #679 — not audited, not production. Design doc: confidential-note-token.md.