Circuit: Keccak-256 hashing

## Summary

Add **Keccak-256** (Ethereum-native) hashing in-circuit.

## Motivation

SHA-256 is implemented; Keccak-256 is required for Ethereum state/trie proofs, address derivation, and many L1↔L2 bridges. Currently deferred due to high constraint cost but remains a top community request.

## Scope

- `Keccak256(nBytes)` — variable-length input with padding
- Optional: `Keccak256_256()` fixed 256-bit block helper

## Notes

- Expect significantly higher constraint count than Poseidon; document benchmarks
- Consider partial implementation (single block) for MVP

## Acceptance criteria

- [ ] NIST/Ethereum test vectors pass
- [ ] Constraint count vs SHA-256 documented in README

Start by locating the existing SHA-256 circuit and its tests, then review how inputs and padding are represented. Implement the scoped Keccak-256 variant and verify NIST/Ethereum test vectors; document constraint-count comparisons with SHA-256 in README.

Written by the indexing model from the issue text.