feat(cli): read the wallet password from env, stdin or a prompt

The password no longer has to be a command-line argument: it can come from
--password-env, --password-stdin or a no-echo prompt (--password still works
but warns). Plaintext storage is now an explicit opt-in (--no-encryption)
instead of the result of a forgotten flag. See ADR 0038.

docs/adr/0038-cli-password-sources-and-explicit-plaintext.md

@@ -0,0 +1,29 @@
+# 0038. CLI password sources and explicit plaintext storage
+
+- **Status:** Accepted
+- **Area:** Distribution
+- **Recorded:** 2026-11-03
+
+## Context
+
+The CLI read the wallet password only from `--password`, where it is stored in the shell history and visible to other local users in the process list (ADR 0024 already noted it). Worse, when `--password` was missing in `create`/`restore*` the CLI printed a warning and stored the **seed in plaintext**: a forgotten flag silently produced an unencrypted wallet.
+
+## Decision
+
+- Password sources, one at most per command: `--password-env NAME`, `--password-stdin` (first line), or `--password P` (kept for compatibility, prints a warning on stderr). With none, a no-echo prompt on the terminal (`Console.ReadKey(intercept: true)`), with a confirmation when creating a wallet. With no terminal the command fails with a clear message and never hangs.
+- A new wallet (`create`, `restore`, `restore-xpub`, `restore-address`) is stored unencrypted **only** with `--no-encryption`, which prints a warning and cannot be combined with a password option. An empty password is refused.
+- Opening: a plaintext wallet needs no password; an encrypted one needs a source. The password used to open is reused to save the wallet back (`sync`).
+- Implemented in `src/Cli/CliPassword.cs`; the command logic in `Program.cs` only asks it for the password.
+
+## Consequences
+
+- A forgotten flag can no longer produce a plaintext wallet; scripts that relied on that must add `--no-encryption` (recorded as a behaviour change in the changelog).
+- `--password` is not removed, so existing scripts with a password keep working; removing it is left to a major version.
+- The environment variable route still exposes the password to processes that can read the environment of the CLI; it is safer than an argument but not a hardened interface (the CLI remains a developer tool).
+
+## References
+
+- `src/Cli/CliPassword.cs`
+- `src/Cli/Program.cs`
+- `tests/PalladiumWallet.Tests/App/CliTests.cs`
+- Related: 0024