docs(browser): add a wallet-security page for the extension's self-custody wallet

[MichaelTaylor3d]

Summary

• Adds docs/browser/wallet-security.md: a progressive-disclosure page on how the DIG Chrome extension's built-in Chia wallet protects a user's keys.
  • Plain-language section (everyone): keys never leave the device, encryption at rest, phishing/scam warnings, revocable per-site permissions, clear-signed transaction approval, address-poisoning defenses, backup/watch-only options.
  • "For protocol developers" section (integrators/reviewers): Argon2id/AES-256-GCM keystore parameters, offscreen key residency + auto-lock, the connect/sign perimeter (origin risk, permissions, spend-risk heuristics, signer accountability), address-poisoning classifier, supply-chain build hardening, and an explicit residual-risk/non-goals list.
• Fixes a factual gap found while writing this page: window-chia-reference.md already correctly attributes window.chia to both the DIG Browser and the DIG Chrome extension, but using-window-chia.md and concepts.md still attributed it to the DIG Browser alone. Both now describe both injectors.
• Cross-links the new page from using-window-chia.md, window-chia-reference.md, concepts.md, and the integration-developers/content-consumers audience pages.
• Wires the page into sidebars.ts (Integration developers + Content consumers) and materializes it across all 14 locales (English source + 13 locale copies, consistent with the existing pattern for new pages in this repo).
• Version 0.3.8 → 0.3.9 (patch — docs-only, no behavior change).

Companion to DIG-Network/dig-chrome-extension#106 (the extension's SPEC.md §15 security-model consolidation) and DIG-Network/dig_ecosystem#81.

Test plan

• npm run typecheck — clean
• npm run build — green across all 14 locales (onBrokenLinks/onBrokenAnchors: "throw" — no broken links/anchors); dist/llms.txt, sitemap.xml, robots.txt present; new page appears in the sitemap with hreflang alternates
• npm run test:unit — pass
• npm run test:a11y — same pass/fail profile as a clean baseline build (verified by rebuilding baseline main and re-running); no new failures introduced by this content-only change