wallet: derive SQL-only private keys via keyVault

When waddrmgr reports an account or scope miss, the legacy
DeriveFromKeyPathCache fallback also fails for accounts that
only live in the SQL store. Fall back to the encrypted
account-level private key fetched from the store cache,
decrypt it through keyVault, derive the requested branch and
index, and zero intermediate key material before returning.

Add SQLite-backed signing coverage for a SQL-only derived
account in signer_test so the fallback exercises a real
SQL store end-to-end and the existing kvdb-backed coverage
keeps regressing the legacy path.

Author: yyforyongyu