M1: persistent vault, local unlock key, sync client, test vectors

kv-store: SQLite (bundled) and in-memory Store holding only ciphertext
envelopes, with base copies for three-way merges and a 10-version history.

kv-ffi: VaultCore::open(path); persisted account record; local unlock key
(enable/unlock_with_local_key/disable); async sync API (configure_server,
set_device_signer, register_account, login, sync_now, logout, devices);
DeviceSigner foreign trait; IntegrityAlarm/PinMismatch/... error variants.

kv-sync: reqwest + rustls (TLS 1.3 only, ring) with SPKI pinning; OPAQUE
client on kv-proto's OpaqueSuite; RFC 9421 signing per kv_proto::httpsig;
pull/push with If-Match, field-level three-way merge, edit-beats-delete;
signed manifest (canonical CBOR, Merkle root, prev chain, Ed25519) with
rollback/fork/Merkle checks as hard integrity alarms. Tested against a
wiremock fake server, plus an #[ignore] test against kestrove-server.

kv-crypto: gen-vectors example and tests reproducing kestrove-spec/vectors.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/kv-sync/Cargo.toml

@@ -8,5 +8,38 @@ publish.workspace = true
 
 [dependencies]
 kv-proto.workspace = true
+kv-crypto.workspace = true
+kv-model.workspace = true
+kv-store.workspace = true
 uuid.workspace = true
 thiserror.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+base64.workspace = true
+sha2.workspace = true
+rand_core.workspace = true
+zeroize.workspace = true
+opaque-ke.workspace = true
+reqwest.workspace = true
+rustls.workspace = true
+webpki-roots.workspace = true
+rustls-webpki.workspace = true
+tokio.workspace = true
+ciborium.workspace = true
+blake3.workspace = true
+p256.workspace = true
+time.workspace = true
+url.workspace = true
+wiremock = { workspace = true, optional = true }
+
+[features]
+# In-memory fake of kestrove-server for tests (also used by kv-ffi's tests).
+test-server = ["dep:wiremock"]
+
+[dev-dependencies]
+kv-sync = { path = ".", features = ["test-server"] }
+rcgen.workspace = true
+tokio-rustls.workspace = true
+tempfile.workspace = true
+rustls.workspace = true
+tokio = { workspace = true }