Nansen Wallet Keychain Migration

Handles the awkward transition from nansen-cli's old password storage (env files, .credentials) to the new keychain-backed system. You'll want this when users hit the "Password loaded from insecure .credentials file" warning or mention they stored credentials in ~/.nansen/.env. The skill walks through four migration paths depending on where the password currently lives, always verifying the keychain actually decrypts the wallet afterward with `nansen wallet export`. The verification step matters because `wallet show` doesn't touch the password at all, so it won't catch a botched migration. Main gotcha is that agents can't use interactive prompts, so everything routes through NANSEN_WALLET_PASSWORD env var or sourcing existing files in the same shell.