[token-cli] Add --decrypt flag to display for confidential balances

[AyushAgrawal-A2]

Problem

spl-token display only shows the ciphertexts of confidential transfer balances; there is no way to see the decrypted pending/available balance (or the confidential supply of a mint-burn mint) from the CLI.

Fixes #145

Summary of changes

• Add --decrypt (and --owner <KEYPAIR>) to spl-token display.
  • Keys are derived from the signer with derive_confidential_keys (same as the other confidential commands, no raw key argument). The derived ElGamal pubkey is checked against the on-chain one before decrypting, with a fallback to the legacy pre-HKDF derivation; a mismatch produces a clear error instead of a slow failing discrete-log search.
  • Token accounts: decrypts pending balance (ElGamal lo/hi via ApplyPendingBalanceAccountInfo::get_pending_balance) and available balance (AES via get_available_balance), shown as Decrypted Pending Balance / Decrypted Available Balance under the Confidential transfer: section and as decryptedConfidentialBalances in JSON output.
  • Mints with ConfidentialMintBurn: decrypts the supply via SupplyAccountInfo::decrypted_current_supply, shown as Decrypted Supply / decryptedConfidentialSupply.
• Render the ConfidentialMintBurn extension in display (previously fell through to _ => Ok(())).
• Tests: assertions in confidential_transfer (after deposit, apply, transfer, withdraw; wrong signer errors; no field without --decrypt) and confidential_mint_burn (supply after mint, text-mode section rendering).

Notes:

• The auditor ElGamal key cannot decrypt account state (only transfer amounts inside transactions), so --decrypt is documented as owner/supply-authority only.
• SupplyAccountInfo::decrypted_current_supply can only recover the supply while the decryptable supply is within 2^32 base units of the ElGamal supply (burns don't update the decryptable supply). After larger applied burns display --decrypt on the mint returns an explanatory error; the CLI's confidential mint has the same pre-existing limitation.

Example:

$ spl-token display <ACCOUNT> --decrypt
  ...
  Confidential transfer:
    ...
    Actual Pending Balance Credit Counter: 0
    Decrypted Pending Balance: 50
    Decrypted Available Balance: 0

🤖 Generated with Claude Code