kv-proto: OPAQUE suite, RFC 9421 signing profile and M1 auth wire types

Adds the OpaqueSuite (Ristretto255 OPRF, TripleDH, SHA-512, identity KSF)
shared by client and server, the httpsig signature-base builders, and the
setup/credentials/account/device/SSE types for milestone M1.
Cargo.lock changes only for kv-proto's new dependencies.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/kv-proto/Cargo.toml

@@ -10,6 +10,10 @@ publish.workspace = true
 serde.workspace = true
 uuid.workspace = true
 base64.workspace = true
+sha2.workspace = true
+# OPAQUE cipher suite shared by client and server (docs/02 "Authentication to the server").
+opaque-ke = { version = "3", default-features = false, features = ["ristretto255-voprf", "std"] }
 
 [dev-dependencies]
 serde_json.workspace = true
+rand_core.workspace = true