Add the GetAccountSecret query to the pg and sqlite account query sets
and regenerate the sqlc bindings. The query joins accounts to key_scopes
and left-joins account_secrets so callers can distinguish a watch-only
account (no secret row) from an absent account. Generated code is kept
in its own commit, separate from the hand-written Go that consumes it.

(cherry picked from commit 99c5994)

Add the AccountSecret result type and the GetAccountSecretQuery selector,
plus the GetAccountSecretQuery.Validate helper and the
ErrAccountSecretUnavailable sentinel. AccountSecret carries only encrypted
private-key material; decryption stays with the wallet key vault. These
types back the per-backend GetAccountSecret implementations that follow.

(cherry picked from commit dc242ba)

Add the PostgreSQL Store.GetAccountSecret method backed by the generated
GetAccountSecret query. It validates the selector, maps the row to the
backend-independent AccountSecret, and reports a typed ErrAccountNotFound
when no account row matches. The method is not yet part of the AccountStore
interface; that wiring lands once every backend implements it.

(cherry picked from commit 69c0b75)

Add the SQLite Store.GetAccountSecret method backed by the generated
GetAccountSecret query, mirroring the PostgreSQL implementation: validate
the selector, map the row to AccountSecret, and surface ErrAccountNotFound
for a missing account. Interface wiring lands once all backends implement
it.

(cherry picked from commit cf0865f)

Add GetAccountSecret to the AccountStore interface now that pg and sqlite
implement it, and complete the remaining implementations: the kvdb backend
reports ErrAccountSecretUnavailable (legacy secrets stay in waddrmgr), and
the testify mock store gains the method. The runtime cache exposes a
pass-through GetAccountSecret seam, and an itest covers derived, watch-only,
and absent-account outcomes.

(cherry picked from commit 21ce20d)

Build the keyVault from kvdb.NewLegacyManagerVault during Load and
OpenWithRetry instead of the not-yet-implemented keyvault.NewDBVault stub.
The kvdb-open path now flows wallet auth and key-material encryption through
a real legacy-backed vault while behavior stays unchanged. The SQL-open path
keeps the DBVault stub until its runtime crypto lands.

(cherry picked from commit 2d073a5)

Route handleUnlockReq and handleLockReq through the key vault instead of
the wallet-owned DBUnlock helper, and delete DBUnlock and its test. Unlock
passes a negative timeout so the controller keeps owning its auto-lock
timer; Lock is void, with the idempotent ErrLocked swallow now living in
the vault.

The vault interface has no passphrase-change method, so the passphrase
rotation stays in the wallet: handleChangePassphraseReq persists the change
through DBPutPassphrase and then asks the vault to refresh its runtime state
on a private rotation. The controller tests assert against the vault and the
restored DBPutPassphrase path.

(cherry picked from commit da88730)

Add deriveStoredAccountChildKey, which decrypts an account's encrypted
private key through the key vault and derives the branch/index leaf key
while zeroing intermediate material, and isWaddrmgrAccountClassError for
classifying waddrmgr scope/account misses. Also add the ErrWatchOnlyAccount
and ErrAccountNotInStore sentinels. These primitives back the store-backed
signer fallback wired in next.

(cherry picked from commit be8bb18)

Add derivePathPrivKey and resolveDerivedPrivKeyFromStore, and thread a
context through the signing paths (ECDH, SignDigest, ComputeRawSig,
DerivePrivKey and the output/imported-key helpers). When the legacy
waddrmgr lookup misses on a scope or account, resolve the account's
encrypted private key from the Store and derive the leaf key through the
key vault, with precise watch-only and not-in-store errors. Covers
SQL-only accounts that have no mirrored waddrmgr row.

(cherry picked from commit de9ddb6)

…BT account

#13: mirror deprecated public-key + taproot-script imports into w.store for SQL
(skip the redundant kvdb mirror, where the legacy manager is the store).
#14: DerivePubKey falls back to the account xpub from the store for SQL-only
accounts (resolveDerivedPubKeyFromStore), matching the privkey fallback.
#15: parseBip32Path sets InternalAccount alongside Account so non-zero-account
PSBT signing resolves the correct account secret instead of account 0.

(cherry picked from commit ca4c9d4)

# Conflicts:
#	wallet/signer_test.go