fix(privacy): keep shared secrets out of decryption diagnostics

[3esmit]

Problem

EncryptionScheme::decrypt includes the full derived shared-secret bytes in stdout when decrypted account decoding fails. The same diagnostic also prints ciphertext and a nullifier. Secret material should not be emitted by a library failure path or captured in ordinary application logs.

Source evidence

• lee/state_machine/core/src/encryption/mod.rs: the Account::from_cursor error handler formats shared_secret.0 inside println! before returning None.
• lez/wallet/src/lib.rs: wallet note decryption calls this library function.

This report is based on the direct source path. No real wallet data, secret values, or claim of observed production exposure is included.

Expected repair

• Remove secret-bearing stdout from the decryption failure path while preserving the existing Option return contract and validation behavior.
• Add a focused synthetic-input regression proving a malformed decrypted account returns None without printing secret material.
• Verify valid account-note round trips and wallet tests remain passing.
• Do not add broad logging or diagnostic-policy changes unrelated to this boundary.