Merge branch 'watch-only'

Adds a pure address-only watch-only wallet mode (Core + CLI + App wizard
+ Send UI), on top of the existing xpub/xprv/WIF import flows which are
unchanged. TransactionFactory already refuses to sign for any IsWatchOnly
account, so the new address-only accounts inherit that guarantee for free.

src/Core/Storage/WalletDocument.cs

@@ -40,6 +40,9 @@ public sealed class WalletDocument
     /// <summary>Imported WIF keys (in plaintext in the document — must be encrypted!).</summary>
     public List<string>? WifKeys { get; set; }
 
+    /// <summary>Watch-only addresses with no associated private key (pure address import).</summary>
+    public List<string>? WatchAddresses { get; set; }
+
     /// <summary>Gap limit for address scanning (§5), configurable.</summary>
     public int GapLimit { get; set; } = 20;