Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

rewrite field element from 10×26-bit schoolbook to 5×52-bit
unsaturated limbs (ported from libsecp256k1 field_5x52_int128_impl.h).
25 products per mul vs 100 — roughly 2x field speedup on arm64.

add Fermat scalar inversion s^(n-2) via addition chain (253 sq + 40 mul),
replacing stdlib divstep (769 iterations). ported from secp256k1-voi.

lazy runtime initialization for 32×256 base point table (comptime
interpreter can't handle u128 arithmetic at this scale).

rename Fe26→Fe, AffinePoint26→AffinePoint — names now match the
implementation. remove redundant P1/P2/P3 constants.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- extend G_TABLE from [16][256] to [32][256] for full 256-bit scalar coverage
- u1*G: direct byte-at-a-time lookup, no GLV split, zero doublings
- u2*Q: Jacobian precompute tables, no batchToAffine field inversion

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>