fix(cli): incorrect/unnecessary passphrase assumptions

[0xferrous]

What

Don't make empty passphrase assumptions in wallet create/import/export/decrypt.

Why

read_passphrase currently:

1. tries to read passphrase from env vars OWS_PASSPHRASE, LWS_PASSPRASE.
2. checks if it is an interactive terminal, if it is, it prompts the user for passphrase
3. if it is not an interactive terminal, it assumes passphrase to be "".

Given this, there is no need for us to assume:

1. Empty passphrases for ows wallet import, ows wallet create. This assumption creates poor security for human users.
2. Empty passphrase while decrypting the signing key, this assumption causes 2x the time for all wallets encrypted without "", even in cases when OWS_PASSPHRASE was explicitly set.

Closes #

Testing

• cargo test --workspace passes
• cargo clippy --workspace -- -D warnings is clean
• npm test passes (if Node bindings changed)
• Tested manually with ows CLI

Notes

Anything reviewers should know.

[vercel]

@0xferrous is attempting to deploy a commit to the MoonPay Team on Vercel.

A member of the Team first needs to authorize it.

[dustytext-bot]

We ran into this exact issue in production with an AI agent (OpenClaw) managing wallets via the OWS CLI.

Impact: Without passphrase encryption on wallet import, any process with filesystem access can export mnemonics with an empty passphrase. Worse, an AI agent with shell access can be prompted to reveal wallet mnemonics — we demonstrated this during testing. ows wallet export --wallet <name> returns the mnemonic with no authentication when the wallet was imported without a passphrase.

Security concern: This is especially dangerous for agent-managed wallets. Prompt injection attacks can trick an agent into running ows wallet export and exfiltrating the mnemonic. The passphrase is the only thing that prevents this — and ows wallet import silently skips it.

Current workaround: We discovered that only wallets created via zerion wallet create (which prompts for a passphrase and passes it to ows.createWallet()) get proper encryption. Wallets created via ows wallet create or ows wallet import are unencrypted and accessible to any process on the machine.

This PR is the right fix — prompting for passphrase on both create and import brings the CLI in line with the security model that the API already supports. Would love to see this merged.