[peter941221]

Closes #755.

This is the smallest first step for the existing G1 transform path discussed in the issue. It keeps the current ToLagrangeG1 API and adds the reverse direction as ToCanonicalG1, without introducing a direction enum or a broader ECNTT surface.

The implementation stays generator-driven. It extracts a shared internal helper in the KZG template, reuses the same G1 FFT path for both directions, and only applies inverse scaling on the inverse/Lagrange direction. Because KZG is generated, the same API appears in all generated KZG curve packages, but the motivating use case remains the BN254 multiproof workflow behind #755.

I regenerated the generated KZG files and validated the change with go test ./internal/generator/kzg and go test ./ecc/bn254/kzg ./ecc/bls12-377/kzg ./ecc/bls12-381/kzg ./ecc/bls24-315/kzg ./ecc/bls24-317/kzg ./ecc/bw6-633/kzg ./ecc/bw6-761/kzg.

---

Note

Medium Risk
Changes KZG G1 FFT transform logic shared by SRS basis conversion; incorrect direction or scaling would break cryptographic correctness, though behavior is guarded by round-trip and reference tests.

Overview
Adds ToCanonicalG1 as the inverse of ToLagrangeG1, converting power-of-two G1 vectors from Lagrange evaluations back to canonical (monomial) form via forward FFT on the existing G1 FFT path.

ToLagrangeG1 is refactored to delegate to a shared transformG1(..., inverse) helper; twiddle setup moves to computeTwiddles(size, inverse), and the 1/n scaling runs only on the inverse (Lagrange) direction. The KZG generator templates are updated and the same API lands in every generated curve kzg package.

New tests cover canonical conversion (against scalar FFT reference), Lagrange↔canonical round-trip, non-power-of-two rejection, plus BenchmarkToCanonicalG1.

^{Reviewed by Cursor Bugbot for commit a51914e. Bugbot is set up for automated code reviews on this repo. Configure here.}