Add multi-input spend (note consolidation) to the note token core

🧐 Motivation

The biggest practical hole in the family. Every spend consumes exactly one input note, so nothing larger than the holder's biggest note is payable and balances fragment forever with no way to consolidate.

📝 Details

• Needs a _join / two-input _consumeNote in the core — it requires the commitment tree and the nullifier set, so it is not expressible as an extension.
• Two nullifiers per spend, two membership proofs; value conservation extends to the multi-input sum.
• Watch the cost: _consumeNote is already k=14 / ~12.2k rows and the Regulated transfer is k=18 / ~136k rows.
• Transaction-shape leakage changes: input count becomes a visible fact unless outputs/inputs are padded to a fixed shape.

Planned, not in #679 (confidential-note-token.md §0).

Start with confidential-note-token.md §0 and compare the planned work with issue #679. Then locate the core _consumeNote implementation and its commitment-tree and nullifier-set handling. Done means the core supports multi-input spends while covering the stated proof, value-conservation, cost, and transaction-shape considerations.