kv-import: 1Password .1pux and CSV import, encrypted export (M5)

New crate kv-import (pure parsing, no store) and kv-ffi/src/import.rs:
- .1pux: accounts -> vaults -> items; Login/Password/Card/Note/Identity mapped, other categories
  as secure notes; unmapped fields appended to notes; attachments and password history reported.
- CSV: 1Password 8 export and generic headers (aliases, BOM, quotes, embedded newlines,
  extra columns into notes).
- Duplicates on (title, username, URL host): skip or add " (imported)".
- Encrypted export KVEX v1: Argon2id (>= account KDF minimum) + XChaCha20-Poly1305,
  authenticated header, padded JSON; restorable through import.
- Caps: 100 MB input, 64 MB decompressed export.data, 10k zip entries, 100k items.
- FFI: VaultCore.import_preview / import_commit / export_encrypted (unlocked only); items are
  sealed, seq-stamped and queued for sync like save_item.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/kv-ffi/Cargo.toml

@@ -20,6 +20,7 @@ kv-crypto.workspace = true
 kv-model.workspace = true
 kv-store.workspace = true
 kv-sync.workspace = true
+kv-import.workspace = true
 serde.workspace = true
 hkdf.workspace = true
 sha2.workspace = true
@@ -33,3 +34,4 @@ uniffi = { workspace = true, features = ["cli", "tokio"] }
 [dev-dependencies]
 kv-sync = { workspace = true, features = ["test-server"] }
 tempfile.workspace = true
+zip = { version = "9", default-features = false, features = ["deflate-flate2"] }