Orgchain v1.3: Taproot and SegWit addresses for every node

Every account now lists standard Bitcoin addresses, so no one has to
derive them: Taproot (BIP-86, m/86'/1'/account'/0/0), which holds the
node's inscription, signs its acts and receives inscriptions, and
SegWit (BIP-84, m/84'/1'/account'/0/0) for payments, beside its npub
(NIP-06). An org is account 0 of its seed and its agents are accounts
1..n, so a wallet that opens an account finds the same addresses. The
lineage key tree page derives the same branches on mainnet paths and
lists the addresses in each agent's keyring.

The v1.2 tapkey (the npub's key, tweaked) is replaced by the standard
BIP-86 key; labs keyed by v1.1 or v1.2 keep their chain keys until
they are reset. Tests pin BIP-86 and BIP-84's own vectors.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4upF5LVwmPDDqrhdUfnXh

AGENTS.md

@@ -9,7 +9,8 @@ Orgchain is lineage's app for creating and operating lineage holdings on Super T
   rather than rewriting it, and keep its tests passing. Preserve upstream licenses and provenance.
 - Keys follow the tree (`src/orgchain/keys.js`): store roots only (one per holding, one per graduated org) and derive
   every other key from its position. Every act is signed by whichever key holds the authorizing inscription.
-- A node's chain key is its tapkey: its npub with the BIP-86 tweak. Leaves are HKDF-SHA256 (salt `lineage/v0`) and
-  must stay byte for byte with lineage's key tree page; `tests/keys.test.js` holds values read off that page.
+- A node's chain key is its account's BIP-86 Taproot key (`m/86'/1'/account'/0/0`); SegWit is BIP-84 at the same
+  account. Leaves are HKDF-SHA256 (salt `lineage/v0`) and must stay byte for byte with lineage's key tree page;
+  `tests/keys.test.js` holds values read off that page.
 - The page makes no network requests; keep it that way (the deployed CSP sets `connect-src 'none'`).
 - Before shipping: `npm test`, `npm run build`, `npm run test:e2e`.