Add descriptor proposal authorization

[kwsantiago]

Problem

Any member of a FROST group can currently call request_descriptor and propose a new wallet policy. In company treasury setups, only designated roles (e.g., CFO, CEO) should be able to initiate descriptor coordination — other members should only contribute and verify.

Solution

Add a descriptor_proposers field to FROST group configuration:

pub descriptor_proposers: HashSet<u16>,  // share indices allowed to propose

Changes needed

• Add descriptor_proposers field to group metadata storage in keep-core (alongside existing share/key package data)
• Check authorization in handle_descriptor_propose() in node/descriptor.rs — reject proposals from non-authorized share indices
• Default: all members can propose (backwards compatible)
• CLI: keep frost set-proposers --group <hex> --indices 1,2
• Mobile: expose via UniFFI for Android wallet settings

Context

For groups that know each other (company treasury, family vault), restricting who can propose policy changes prevents confusion from multiple competing proposals and limits the attack surface if a single device is compromised.