feat(kzg): add canonical G1 transform

[peter941221]

Closes #755.

This is the smallest first step for the existing G1 transform path discussed in the issue. It keeps the current ToLagrangeG1 API and adds the reverse direction as ToCanonicalG1, without introducing a direction enum or a broader ECNTT surface.

The implementation stays generator-driven. It extracts a shared internal helper in the KZG template, reuses the same G1 FFT path for both directions, and only applies inverse scaling on the inverse/Lagrange direction. Because KZG is generated, the same API appears in all generated KZG curve packages, but the motivating use case remains the BN254 multiproof workflow behind #755.

I regenerated the generated KZG files and validated the change with go test ./internal/generator/kzg and go test ./ecc/bn254/kzg ./ecc/bls12-377/kzg ./ecc/bls12-381/kzg ./ecc/bls24-315/kzg ./ecc/bls24-317/kzg ./ecc/bw6-633/kzg ./ecc/bw6-761/kzg.

---

Note

Medium Risk
Adds a new G1 FFT direction (ToCanonicalG1) and refactors the existing transform path across all generated KZG curve packages; while covered by tests/benchmarks, it touches performance- and correctness-sensitive cryptographic code.

Overview
Adds ToCanonicalG1 (Lagrange evals → canonical coeffs) alongside the existing ToLagrangeG1 in all generated KZG curve packages.

Refactors the shared G1 FFT code into a single transformG1(points, inverse) helper and generalizes twiddle generation to support both forward and inverse transforms, applying the 1/n scaling only for the inverse/Lagrange direction.

Expands generated tests to cover canonical conversion, round-trips, and non-power-of-two rejection, and adds a BenchmarkToCanonicalG1 plus small scalar/point helpers to build deterministic transform fixtures.

^{Reviewed by Cursor Bugbot for commit c7e29dc. Bugbot is set up for automated code reviews on this repo. Configure here.}