Circuit: ECDSA verify (secp256k1)

## Summary

Implement **ECDSA signature verification** over secp256k1 for Ethereum transaction and message proofs.

## Motivation

Enables ZK proofs of "I signed this" or "this tx was authorized" — common in account abstraction, bridges, and identity. Deferred in roadmap due to cost; popular in circomlib ecosystem.

## Scope

- `ECDSAVerify()` — verify (r, s) on message hash under pubkey (x, y) or compressed key
- Range checks on r, s per ECDSA spec
- Test vectors from known Ethereum signatures

## Security notes

- malleability: enforce low-s or document requirement
- message hash domain (EIP-191, EIP-712) is off-circuit responsibility

## Acceptance criteria

- [ ] Pass standard secp256k1 verify vectors
- [ ] Document constraint budget and recommended proof system params

The issue names no implementation files or test entry points. Start by reviewing existing circuit templates and the project’s testing setup, then identify how standard secp256k1 vectors and constraint-budget documentation are represented; done means the listed verification and acceptance checks pass.

Written by the indexing model from the issue text.