fix: TxAuth7702 silently maps missing chain_id to all-chains wildcard

The packaged Python client's TxAuth7702 constructor accepted
chain_id=None and silently coerced it to 0. The TLV with chain_id=0
crossed the host->device boundary and was interpreted by the firmware
as CHAIN_ID_ALL, producing an authorization signature valid on every
chain. A bridge or dApp integration carrying chain_id through Optional
types could end up requesting a far broader signing scope than intended
without any client-side warning.

Tighten the type contract: chain_id is now a required int, with no
Optional in the signature and no silent coercion of None. Callers that
genuinely want an all-chains authorization must pass the explicit
TxAuth7702.CHAIN_ID_ALL sentinel.

(cherry picked from commit 4f48c980d10645813192cac67acd0abb9bad2c9c)