feat(core): support pure watch-only address import

Adds a WalletDocument.WatchAddresses field and WalletLoader.NewFromAddresses
to build an ImportedKeyAccount with no private key at all (unlike xpub/WIF
imports, which can still derive/hold key material). ScriptKind is inferred
from the address itself via a new DerivationPaths.KindFor helper. Signing
already refuses to run for any IsWatchOnly account (TransactionFactory), so
this only had to wire up construction/reload of the new account shape.

src/Core/Storage/WalletDocument.cs

@@ -40,6 +40,9 @@ public sealed class WalletDocument
     /// <summary>Imported WIF keys (in plaintext in the document — must be encrypted!).</summary>
     public List<string>? WifKeys { get; set; }
 
+    /// <summary>Watch-only addresses with no associated private key (pure address import).</summary>
+    public List<string>? WatchAddresses { get; set; }
+
     /// <summary>Gap limit for address scanning (§5), configurable.</summary>
     public int GapLimit { get; set; } = 20;