test: backfill negative properties, error branches, and non-zero DKG ctx

[iamquang95]

Fix #646

Test-only. 7 files, every hunk inside a #[cfg(test)] module. No production change. 111 -> 191 tests (pluto-crypto 44->91, pluto-frost 49->64, pluto-k1util 18->36).

The existing suites assert mostly positive round trips and operator
relationships — scalar * scalar.invert() == ONE holds for any consistently
wrong pair of operations, and a verify hard-wired to Ok(true) passes every
test that only feeds it good signatures. These are the assertions that can fail.

crates/k1util/src/k1util.rs (+18)

• verify_64 / verify_65_returns_false_for_wrong_signature — wrong key, wrong hash, corrupted R
• verify_64 / recover / sign_rejects_wrong_length_* — expected and actual length asserted
• recover_maps_compact_recovery_ids_to_ethereum_ids — 27/28 pinned onto 0/1, with assert_ne! as the non-vacuity guard
• public_key_from_libp2p_round_trips_secp256k1_key / ..._rejects_non_secp256k1_key

crates/crypto/src/tbls/math.rs (+20, from one test)

• evaluate_polynomial_matches_hand_computed_values — f(x)=7+11x+13x² at x=1,2,5 -> 31,81,387
• evaluate_polynomial_rejects_empty_polynomial, evaluate_polynomial_degree_zero_ignores_x
• lagrange_interpolate_secret_recovers_constant_term — {1,2,3}, {2,4,5}, descending {5,4,2} (the scalar_negate branch)
• lagrange_interpolate_secret_below_threshold_yields_wrong_scalar — pins the exact wrong value r-19, not just "differs"
• lagrange_interpolate_signature_recovers_group_signature, plus duplicate-index and length-mismatch guards on both paths
• aggregate_public_keys_is_additively_homomorphic / ..._of_single_key_is_that_key
• scalar_div_multiplies_by_modular_inverse, scalar_div_rejects_zero_denominator, scalar_negate_computes_additive_inverse

crates/crypto/src/tbls.rs (+11)

• generate_insecure_secret_is_deterministic / ..._returns_raw_rng_draw / ..._exhausts_retry_budget — driven by a ConstantRng, not a lucky seed
• generate_secret_key_derives_from_rng_draw
• empty_inputs_reject_with_distinct_errors — three inputs, three variants
• threshold_aggregate_below_threshold_does_not_verify
• all_entry_points_reject_malformed_signature — the three parse sites that had no coverage
• verify_rejects_malformed_public_key, verify_rejects_identity_signature
• verify_reports_off_subgroup_key_as_verify_failure

crates/crypto/src/types.rs (+16)

• bls_error_from_blst_error — exhaustive 8-row table, BLST_SUCCESS included so the _ arm is pinned
• error_display_carries_wrapped_bls_error, invalid_threshold_display_does_not_swap_fields, conv_error_display_does_not_swap_expected_and_got, threshold_overflow_display_carries_threshold

crates/frost/src/curve.rs (+10)

• scalar_arithmetic_matches_hand_computed_values / scalar_arithmetic_wraps_at_field_edges
• scalar_from_bytes_rejects_field_order_but_wide_reduces_it
• scalar_from_bytes_wide_reduces_modulo_field_order / ..._reduces_largest_input
• g1_arithmetic_matches_independently_computed_points — Add/Sub/Mul against compressed 2G/3G/5G computed outside this crate
• g1_group_laws_hold_for_identity, g1_affine_accepts_identity_that_projective_rejects
• g1_from_compressed_rejects_off_subgroup_point / ..._rejects_malformed_encodings

crates/frost/src/frost_core.rs (+2)

• from_commitments_rejects_off_subgroup_point_at_any_position — collect::<Option<_>>() short-circuits, so a single-element test cannot see position
• from_commitments_rejects_identity

crates/frost/src/kryptology.rs (+3) — the non-zero DKG context

Every pre-existing DKG test pinned ctx = 0, where a dropped context byte is
indistinguishable from one that is used. bls_round_trip_2_of_3 now runs at
ctx = 0x2a; bls_round_trip_3_of_3 keeps ctx = 0.

• ctx_binds_schnorr_proof_but_not_polynomial — same seed, two contexts: identical Feldman commitments, different ci/wi
• round2_rejects_broadcast_from_different_ctx — InvalidProof { culprit: 2 }
• challenge_preimage_is_id_ctx_commitment_nonce — 98 bytes pinned against a hand-built preimage; this is the interop surface with Go kryptology