fn mask_wallet(wallet: &WalletAddress) -> String
Short helper to mask a wallet address in log output: keeps the first 6 and last 4 hex characters, so operators can correlate errors without logging the full identifier.