privacy: drop raw-IP PII columns and the dead wallets table

The published privacy policy states that IP addresses are retained only as a
salted one-way hash for rate limiting. That was true of the login-event path
but not of sessions.ip_address or audit_logs.ip_address, both of which stored
a raw client IP tied to user_id on every login.

Drop both columns and all writer/model code, so the schema enforces the policy
rather than relying on convention. The hashed rate-limit path (login_events,
restore_attempts) is unchanged and remains the only IP retention.

Also drops the `wallets` table, which was created in the initial schema and
never read or written: a latent user_id -> address / view_key store.

The operator forensic trail (admin_audit_logs, admin_sessions) deliberately
keeps its raw IP. Privileged-action forensics is a different threat model and
is not covered by the user-facing claim.

tests/common/mod.rs

@@ -270,7 +270,6 @@ impl TestApp {
                 refresh_token_hash: hash,
                 platform: "web".to_string(),
                 device_info: None,
-                ip_address: None,
                 expires_at: chrono::Utc::now() + chrono::Duration::days(30),
             })
             .await