Sign in with Google, Apple…: item field, bridge save and identities

Items record sign_in_with {provider, account}; the browser bridge reports it
with the site's identities and saves it after the usual app prompt. Items
now keep fields they don't know, so editing in an older app never drops what
a newer one added.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/kv-wasm/src/wasm/mod.rs

@@ -40,10 +40,17 @@ export interface ItemSummary {
   favorite: boolean;
   hasTotp: boolean;
   tags: string[];
+  /** "Sign in with Google…" for the site (docs/05 "Sign in with…"). */
+  signInWith: SignInWith | null;
   /** Unix seconds. */
   modifiedAt: number;
 }
 
+/** `provider` is an id from `signInProviders()` (`google`, `apple`…); `account` the provider account used. */
+export interface SignInWith { provider: string; account?: string | null; }
+
+export interface SignInProvider { id: string; name: string; }
+
 /** `id: ""` creates a new item. Omitted optional fields default to null / [] / false / 0. */
 export interface ItemDto {
   id: string;
@@ -56,6 +63,7 @@ export interface ItemDto {
   notes: string | null;
   favorite: boolean;
   tags: string[];
+  signInWith: SignInWith | null;
   /** Unix seconds; set by the core on save. */
   modifiedAt: number;
 }
@@ -865,6 +873,14 @@ impl VaultCore {
 
 // ---------------------------------------------------------------- free functions
 
+/// The identity providers offered for "Sign in with…", in display order.
+#[wasm_bindgen(js_name = signInProviders, unchecked_return_type = "SignInProvider[]")]
+pub fn sign_in_providers() -> std::result::Result<JsValue, JsValue> {
+    let list: Vec<_> =
+        kv_model::PROVIDERS.iter().map(|(id, name, _)| serde_json::json!({ "id": id, "name": name })).collect();
+    to_js(&list)
+}
+
 #[wasm_bindgen(js_name = generatePassword)]
 pub fn generate_password(length: u32, symbols: bool) -> String {
     core::generate_password(length, symbols)