fix(crypto): handle CT exponent bounds, zero values, and toggle changes

[mswilkison]

Stacked on #8 (constant-time-hardening) and kept as a draft alongside its parent. All review fixes are in this PR; #8 is unchanged.

With CT enabled, a Paillier modulus wider than the auxiliary proof modulus could leave secret exponents encoded at their own byte length. Add ExpCTWithBitLen so callers select a fixed width from a public bound. MtA uses pk.N for Alice's plaintext and Bob's two witnesses; factor proofs use the prover's public N0 for both factors, independently of the verifier's modulus.

ExpCT retains the modulus-byte-width default and now rejects oversized exponents instead of silently extending their encoding. Callers needing larger exponents must use the explicit public-width API. Negative exponents and insufficient bounds panic; exponents are never truncated or reduced.

This also includes the earlier review fixes: zero exponents execute the padded bigmod.Exp path, and ModProof uses one CT-toggle snapshot for context allocation and every use of that context.

Validation:

• The default-width regression fails on the previous PR head, which accepted implicit exponent-width growth, and passes with this patch. Serializer tests check exact widths for zero and values spanning byte boundaries, plus invalid-bound rejection and arithmetic equivalence when the exponent bound differs from the arithmetic modulus.
• Unequal-width Alice, Bob, BobWC, complete MtA, and factor-proof tests verify proofs and compare deterministic CT-off/on transcripts. These tests and the existing zero-plaintext/concurrent-toggle regressions pass with race detection (-count=3).
• All TestExpCT tests pass with race detection. go vet ./common ./crypto/mta ./crypto/paillier, formatting, and git diff --check pass.
• Independent candidate review found no concrete surviving bypasses or regressions in supported input paths.
• Full local make test_unit passes on Go 1.24.1 for this stacked branch. Its inherited tree still contains EdDSA and resharing; EdDSA results were cached. Those protocols were removed from master by Remove unused EdDSA and resharing protocols #5. The feat(crypto): opt-in constant-time path for secret-exponent modexps [DO NOT MERGE] #8/fix(crypto): handle CT exponent bounds, zero values, and toggle changes #10 stack shares ancestor 1b1da04 with current master and does not yet include that removal or the other subsequent master changes. This result validates the stack's present tree, not its eventual integration with current master; integration and validation against current master remain required before merging.
• The full CI test run and formatting CI both pass for follow-up commit cf15377f96bf8f3d522c6de7a626f4a13e6e3649.

The guarantee addressed here is fixed public-width exponentiation work in bigmod; the existing coverage limitations around math/big preprocessing and operations outside the CT path remain.