Synced app settings: colour theme and appearance (beta)

One encrypted settings item per account (a secure note carrying
app_settings, at a fixed per-account id) holds the theme and light/dark
appearance, so it syncs like any item and the server can't read it. Lists
hide it; older apps see a note that explains itself. app_theme /
set_app_theme in kv-ffi and kv-wasm. Also fixes a flaky test that checked
random ciphertext for the letters K1.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/kv-model/src/lib.rs

@@ -7,7 +7,10 @@ pub mod matching;
 pub mod passkey;
 pub mod totp;
 
-pub use item::{normalize_tags, provider_name, Item, ItemKind, Passkey, SignInWith, MAX_TAGS, MAX_TAG_LEN, PROVIDERS};
+pub use item::{
+    app_settings_id, normalize_tags, provider_name, AppSettings, Item, ItemKind, Passkey, SignInWith, MAX_TAGS,
+    MAX_TAG_LEN, PROVIDERS,
+};
 #[cfg(feature = "psl")]
 pub use matching::registrable_domain;
 pub use matching::{match_url, MatchLevel};