Feat/circuit version resolution

[nol4lej]

Groundwork for spending shielded notes under the exact circuit version that created them (not merely the chain's active_version), plus fail-closed artifact integrity.

Breaking

• Removed WebArtifactProvider legacy-URL mode (new WebArtifactProvider('https://...') string constructor). It fetched artifacts by filename convention with no manifest — no sha256/vk_hash to verify, contradicting fail-closed integrity. Construct with new WebArtifactProvider() or new WebArtifactProvider({ baseUrl }) instead; a mirror is now a baseUrl that must serve a manifest.json. Every artifact is now integrity-checked, no exceptions.

Added

• WebArtifactProvider.getResolvedVersion(circuit) → ResolvedCircuitVersion { version, packageVersion, vkHash }: the version the provider will actually use for a circuit (override or manifest active_version), so a consumer (SDK) can cross-check the vkHash against the chain's active VK before proving. New exported type ResolvedCircuitVersion.
• Artifact integrity verification: every downloaded wasm/zkey/ark is sha256-verified against the manifest — a mismatch (tampered/stale CDN) throws and returns no bytes. An artifact absent from the manifest throws rather than being derived by convention.
• CIRCUIT_ID map + circuitTypeToId() (src/circuits/types.ts): single source of truth mapping each CircuitType to its on-chain numeric id, matching the node's CircuitId (Transfer=1, Unshield=2, PrivateLink=5, ValueProof=6). Fails closed — unknown circuit throws rather than defaulting to 0. Anti-drift test (tests/circuits/circuit-id.test.ts) locks the mapping to the node's values.