refactor(core/rust/crypto: introduce testing harness and zkp support

### core/embed/crypto/build.rs
@@ -147,15 +147,20 @@ fn add_crypto_base(lib: &mut CLibrary, common_attrs: &CompileAttrs) -> Result<()
     }
 
     lib.add_rust_bindings(|builder| {
-        Ok(builder
+        let mut builder = builder
             .header(format!("{CRYPTO_PATH}/ecdsa.h"))
             .header(format!("{CRYPTO_PATH}/ed25519-donna/ed25519.h"))
             .header(format!("{CRYPTO_PATH}/elligator2.h"))
             .header(format!("{CRYPTO_PATH}/hmac.h"))
             .header(format!("{CRYPTO_PATH}/nist256p1.h"))
             .header(format!("{CRYPTO_PATH}/secp256k1.h"))
             .header(format!("{CRYPTO_PATH}/sha2.h"))
-            .header(format!("{CRYPTO_PATH}/sha3.h"))
+            .header(format!("{CRYPTO_PATH}/sha3.h"));
+
+        if cfg!(feature = "secp256k1_zkp") {
+            builder = builder.header(format!("{CRYPTO_PATH}/zkp_context.h"));
+        }
+        Ok(builder
             // curve25519
             .allowlist_function("curve25519_scalarmult")
             .allowlist_function("curve25519_scalarmult_basepoint")
@@ -170,6 +175,7 @@ fn add_crypto_base(lib: &mut CLibrary, common_attrs: &CompileAttrs) -> Result<()
             .allowlist_var("nist256p1")
             .allowlist_function("ecdsa_verify_digest")
             .allowlist_function("ecdsa_recover_pub_from_sig")
+            .allowlist_function("zkp_context_init")
             // ed25519
             .allowlist_type("ed25519_signature")
             .allowlist_type("ed25519_public_key")

### core/embed/crypto/src/curve25519.rs
@@ -142,24 +142,8 @@ impl Point {
 
 #[cfg(test)]
 mod test {
-    use std::sync::{LazyLock, Mutex};
-
-    use rand::prelude::*;
-    use rand::rngs::SmallRng;
-
     use super::*;
-
-    static INSECURE_RNG: LazyLock<Mutex<SmallRng>> = LazyLock::new(|| {
-        let time_seed = std::time::SystemTime::now()
-            .duration_since(std::time::UNIX_EPOCH)
-            .unwrap()
-            .as_nanos() as u64;
-        Mutex::new(SmallRng::seed_from_u64(time_seed))
-    });
-
-    fn fill_random_bytes(bytes: &mut [u8]) {
-        INSECURE_RNG.lock().unwrap().fill_bytes(bytes);
-    }
+    use crate::testutil::fill_random_bytes;
 
     fn generate_scalar() -> Scalar {
         let mut bytes = [0u8; CURVE25519_KEY_SIZE];

### core/embed/crypto/src/fault_handler.c
@@ -26,3 +26,15 @@
 void tc_fault_handler(const char *message) {
   system_exit_error(NULL, message, NULL);
 }
+
+#ifdef USE_SECP256K1_ZKP
+void secp256k1_default_illegal_callback_fn(const char *str, void *data) {
+  (void)data;
+  system_exit_error(NULL, str, NULL);
+}
+
+void secp256k1_default_error_callback_fn(const char *str, void *data) {
+  (void)data;
+  system_exit_error(NULL, str, NULL);
+}
+#endif

### core/embed/crypto/src/lib.rs
@@ -1,4 +1,7 @@
 #![cfg_attr(not(test), no_std)]
+#![feature(custom_test_frameworks)]
+#![reexport_test_harness_main = "test_main"]
+#![no_main]
 
 use core::hint::black_box;
 
@@ -17,6 +20,9 @@ pub mod sha256;
 pub mod sha3;
 pub mod sha512;
 
+#[cfg(test)]
+mod testutil;
+
 /// Error returned by cryptographic operations in this crate.
 #[cfg_attr(feature = "test", derive(core::fmt::Debug))]
 pub enum Error {

### core/embed/crypto/src/testutil.rs
@@ -0,0 +1,48 @@
+use std::sync::{LazyLock, Mutex};
+
+use rand::prelude::*;
+use rand::rngs::SmallRng;
+use rtl::CSliceMut;
+
+static INSECURE_RNG: LazyLock<Mutex<SmallRng>> = LazyLock::new(|| {
+    let time_seed = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap()
+        .as_nanos() as u64;
+    Mutex::new(SmallRng::seed_from_u64(time_seed))
+});
+
+pub fn fill_random_bytes(bytes: &mut [u8]) {
+    const IDENTIFIER_MASK: &[u8] = b"<PRNG-Rust-Tests>";
+
+    INSECURE_RNG.lock().unwrap().fill_bytes(bytes);
+
+    for i in 0..bytes.len() {
+        bytes[i] ^= IDENTIFIER_MASK[i % IDENTIFIER_MASK.len()];
+    }
+}
+
+#[unsafe(no_mangle)]
+unsafe extern "C" fn random_buffer(buf: *mut u8, len: usize) {
+    // SAFETY: caller must pass a valid pointer+len
+    let mut slice = unsafe { CSliceMut::from_ptr_and_len(buf, len) };
+    fill_random_bytes(slice.as_slice_mut());
+}
+
+#[unsafe(no_mangle)]
+pub fn main() -> i32 {
+    // Initialize the ZKP context
+    #[cfg(feature = "secp256k1_zkp")]
+    unsafe {
+        crate::ffi::zkp_context_init()
+    };
+
+    // Call the Rust test harness main function
+    // The function panics if any test fails.
+    // Asserting that it returns () to ensure that if a future Rust version
+    // changes the signature and behavior, we'll be notified.
+    assert_eq!(crate::test_main(), ());
+
+    // Return 0 to indicate success
+    0
+}

### core/embed/upymod/modtrezorcrypto/modtrezorcrypto.c
@@ -167,17 +167,4 @@ const mp_obj_module_t mp_module_trezorcrypto = {
 
 MP_REGISTER_MODULE(MP_QSTR_trezorcrypto, mp_module_trezorcrypto);
 
-#ifdef USE_SECP256K1_ZKP
-void secp256k1_default_illegal_callback_fn(const char *str, void *data) {
-  (void)data;
-  mp_raise_ValueError((mp_rom_error_text_t)str);
-  return;
-}
-
-void secp256k1_default_error_callback_fn(const char *str, void *data) {
-  (void)data;
-  error_shutdown(str);
-}
-#endif
-
 #endif  // MICROPY_PY_TREZORCRYPTO