Unify v2 ORE on a single-key API (split the OreCipher trait)

[coderdan]

Goal

Unify the v2 ORE schemes on a single-key API. Today the fixed schemes
take two keys (OreCipher::init(k1, k2) → prf1/prf2) while the chained
scheme is single-key — an inconsistency we want to remove. Signed-off mechanism:
derive the two PRF subkeys from one key via labeled AES (matching how the chained
accumulator derives k_acc):

prf1_key = AES_key(b"ORE.v2.prf1…")
prf2_key = AES_key(b"ORE.v2.prf2…")

Approach: split the trait

Backwards compatibility is about the wire format, not the code, so we can
restructure the trait:

• New single-key init for the v2 schemes (Bit6 + chained) — e.g. with_key(key)
  or a v2 cipher trait with init(key: &[u8;16]).
• Legacy bit2 stays two-key (init(k1, k2)) off the unified path — its
  wire is frozen and its PRF keys are the raw k1/k2; it must keep producing
  byte-identical ciphertexts (compat_vectors).
• Update the ~20 OreCipher::init(k1,k2) call sites (decimal, chrono, benches,
  compat suites) accordingly.

Wire impact

This changes Bit6's key derivation → different ciphertext bytes. Bit6 is not
yet frozen, so this is acceptable but requires regenerating
tests/compat_w6_vectors against the new single-key derivation. Legacy bit2
vectors are unaffected.

Acceptance

• v2 schemes constructed from a single key; labeled-AES subkey derivation.
• Legacy bit2 unchanged (compat_vectors byte-identical).
• compat_w6_vectors regenerated; cargo test + clippy -D warnings green.