Subkey commands: act on EVM vault operator sub-accounts

[amayvs]

Summary

• Adds --vault-operator-address (requires --l1-key) to register-subkey, list-subkeys, get-subkey, revoke-subkey, and update-subkey-allowed-cidrs: the v2 SIWE auth targets the operator address while the message is signed by the owner's eth key, so subkey operations act on the operator's subkeys — how API traders trade an EVM-owned vault (operator_signer_type=eip191). The operator address is the vault's operator_account.
• evm_onboard_and_auth(target_address=…) skips GET /onboarding and the onboarding POST for operator targets (operators are created by vault creation, never POST /v2/onboarding) and authenticates directly.
• The subkey-registration payload is unchanged — account context comes from the JWT.

Testing

• Operator-target auth flow test (no onboarding calls; operator in PARADEX-STARKNET-ACCOUNT; owner address in the SIWE message), command plumb-through test, and --vault-operator-address without --l1-key rejection.
• Full suite: 91 passed.

Usage

paradex-cli register-subkey 0x<subkey_pubkey> --name vault-bot \
  --l1-key $PARADEX_L1_PRIVATE_KEY \
  --vault-operator-address 0x<vault operator_account> --env testnet