chore(security): enhance environment configuration, CI workflows, and wallet daemon with security improvements

- Restructure .env.example with security-focused documentation, service-specific environment file references, and AWS Secrets Manager integration
- Update CLI tests workflow to single Python 3.13 version, add pytest-mock dependency, and consolidate test execution with coverage
- Add comprehensive security validation to package publishing workflow with manual approval gates, secret scanning, and release

apps/wallet-daemon/src/app/deps.py

@@ -6,6 +6,7 @@ from fastapi import Depends
 
 from .keystore.service import KeystoreService
 from .ledger_mock import SQLiteLedgerAdapter
+from .keystore.persistent_service import PersistentKeystoreService
 from .receipts.service import ReceiptVerifierService
 from .settings import Settings, settings
 
@@ -22,8 +23,8 @@ def get_receipt_service(config: Settings = Depends(get_settings)) -> ReceiptVeri
 
 
 @lru_cache
-def get_keystore() -> KeystoreService:
-    return KeystoreService()
+def get_keystore(config: Settings = Depends(get_settings)) -> PersistentKeystoreService:
+    return PersistentKeystoreService(db_path=config.ledger_db_path.parent / "keystore.db")
 
 
 def get_ledger(config: Settings = Depends(get_settings)) -> SQLiteLedgerAdapter: