Introduce `deferred::Product<F>`, a wide 576-bit accumulator (8 limbs
+ 64-bit carry) that replaces the eager `Accumulator = Fp/Fq` in the
DeferredField implementations.
Products are accumulated via an internal `accumulate` method (no
public Add/AddAssign impls), ensuring carry overflow requires 2^64
operations. At reduction time, `partial_reduce` folds the carry and
top limb back into range using 2^512 ≡ R2 (mod p) and 2^448 ≡ B448
(mod p), producing a value < 2^449 < R*p that is safe for the
existing `montgomery_reduce`.
All existing DeferredField tests continue to pass unchanged—the lazy
accumulator is a drop-in replacement for the eager one.
Test the accumulation-based API for both Fp and Fq: single
mul/square round-trips, inner products at various lengths (0–10,000),
reduce-zero identity, square-vs-mul consistency, mixed mul+square
accumulation, and a regression test with adversarial limb values that
exercise the partial-reduction path.
All tests are written against the DeferredField trait API and will
continue to pass when the eager accumulator is swapped for a lazy one.
Add the `deferred` module with a `DeferredField` trait that enables
accumulating multiple unreduced products before performing a single
reduction. The trait uses an accumulation-based API: callers feed
factor pairs into an `Accumulator` via `mul_accumulate` /
`square_accumulate`, then call `reduce` once at the end.
For now, both Fp and Fq implement the trait with `Accumulator = Self`,
performing eager reduction on each accumulation. A later commit will
swap in a wide accumulator that defers reduction for real.
The module is feature-gated behind the `deferred` feature flag.
