crypto: add a Field plaintext pad to EcdhMask

🧐 Motivation

Note delivery needs to hand a recipient a (value, nonce) pair under one ECDH. EcdhMask.encrypt only pads a Uint<128>, and the nonce is a Field. A separate crypto/NoteDelivery module would duplicate the KDF for one extra plaintext type.

📝 Details

contracts/src/crypto/EcdhMask.compact

• Add encryptField / decryptField (or a pair variant sharing one ephemeral) with the same identity and zero-ephemeral guards as encrypt.
• Document the hiding margin: the pad is below 2^248, so a full-width Field plaintext does not get the margin Uint<128> values have.
• Mock re-export and tests follow MockEcdhMask / EcdhMask.test.ts.

Replaces the crypto/NoteDelivery draft from #679. The note structs, OZ:note:* tags and wallet-side recovery move to the Delivery extension (#727).