M1: persistent vault, local unlock key, sync client, test vectors

kv-store: SQLite (bundled) and in-memory Store holding only ciphertext
envelopes, with base copies for three-way merges and a 10-version history.

kv-ffi: VaultCore::open(path); persisted account record; local unlock key
(enable/unlock_with_local_key/disable); async sync API (configure_server,
set_device_signer, register_account, login, sync_now, logout, devices);
DeviceSigner foreign trait; IntegrityAlarm/PinMismatch/... error variants.

kv-sync: reqwest + rustls (TLS 1.3 only, ring) with SPKI pinning; OPAQUE
client on kv-proto's OpaqueSuite; RFC 9421 signing per kv_proto::httpsig;
pull/push with If-Match, field-level three-way merge, edit-beats-delete;
signed manifest (canonical CBOR, Merkle root, prev chain, Ed25519) with
rollback/fork/Merkle checks as hard integrity alarms. Tested against a
wiremock fake server, plus an #[ignore] test against kestrove-server.

kv-crypto: gen-vectors example and tests reproducing kestrove-spec/vectors.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/kv-crypto/examples/gen-vectors.rs

@@ -0,0 +1,32 @@
+//! Writes the cross-implementation test vectors.
+//!
+//! ```sh
+//! cargo run -p kv-crypto --example gen-vectors            # in-repo copy + ../kestrove-spec/vectors if present
+//! cargo run -p kv-crypto --example gen-vectors -- <dir>   # explicit output directory
+//! ```
+
+use std::path::PathBuf;
+
+#[path = "../vectors/gen.rs"]
+mod gen;
+
+fn main() {
+    let manifest = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let mut dirs: Vec<PathBuf> = std::env::args().skip(1).map(PathBuf::from).collect();
+    if dirs.is_empty() {
+        dirs.push(manifest.join("tests/vectors"));
+        let spec = manifest.join("../../../kestrove-spec/vectors");
+        if spec.is_dir() {
+            dirs.push(spec);
+        }
+    }
+    let docs = gen::generate();
+    for dir in &dirs {
+        std::fs::create_dir_all(dir).expect("create output dir");
+        for (name, doc) in &docs {
+            let path = dir.join(format!("{name}.json"));
+            std::fs::write(&path, gen::render(doc)).expect("write vector file");
+            println!("wrote {}", path.display());
+        }
+    }
+}