feat: add Groth16 zk-SNARK Prover with Web Worker offloading and integrity verification

[jchinedu]

Closes #69

Summary

Implements a highly optimized ZK Prover module that abstracts all SnarkJS complexity for Groth16 proof generation in Whitechain's privacy-preserving governance voting system.

Changes

New files in src/zk/

• Prover.ts - Main public facade. Orchestrates the full pipeline: fetch artifacts ? verify integrity ? prove in Worker ? format calldata.
• worker.ts - Inline Web Worker source (spawned as a Blob URL). Offloads snarkjs.groth16.fullProve off the main thread so the browser UI never freezes. Falls back to main-thread execution in Node.js/SSR environments automatically.
• �rtifacts.ts - Secure CDN fetching with in-memory caching and exponential backoff. Prevents redundant downloads on repeated prove() calls.
• integrity.ts - SHA-256 integrity verification using the Web Crypto API (globalThis.crypto.subtle). Verifies .wasm and .zkey files before execution to prevent supply-chain attacks.
• **ormat.ts** - Converts raw SnarkJS JSON output into Solidity-compatible uint256 calldata, including the BN254 G2 coordinate reversal required by the on-chain Groth16 verifier.
• ** ypes.ts** - Shared interfaces: ZkProverOptions, Groth16Proof, ProofCalldata, FetchedArtifacts.
• index.ts - Barrel export.

Updated files

• src/index.ts - Exports the zk module from the root entry point.
• package.json - Adds snarkjs >=0.7.0 as an optional peerDependency and a dedicated ./zk subpath export. Non-ZK users pay zero bundle cost.

New tests in ests/zk/ (25 new tests)

• ormat.test.ts - Validates BN254 coordinate reversal and bigint conversion.
• integrity.test.ts - Tests SHA-256 verification including tampered buffer detection.
• �rtifacts.test.ts - Tests CDN fetch, in-memory caching, and integrity rejection.
• Prover.test.ts - End-to-end pipeline tests with mocked SnarkJS and error paths.

Usage

import { ZkProver } from 'whitechain-sdk'

const prover = new ZkProver({
  wasmUrl: 'https://cdn.example.com/vote.wasm',
  zkeyUrl: 'https://cdn.example.com/vote_final.zkey',
  wasmHash: 'abc123...', // optional SHA-256 for integrity
  zkeyHash: 'def456...', // optional SHA-256 for integrity
})

// Runs in a Web Worker - UI stays fully responsive
const calldata = await prover.prove({ nullifier: '123', voteOption: '1' })

// Pass directly to the on-chain verifier
await governanceContract.castVote(calldata.pA, calldata.pB, calldata.pC, calldata.pubSignals)

Test Results

148/148 tests passing (21 test files).

[Lakes41]

This PR cannot be merged automatically because it has merge conflicts.

Please update the branch with the latest base branch and resolve the conflicts.

After the conflicts are resolved and checks pass, the automation can review it again.