Passkeys for the browser extension, tags in item lists

The browser bridge answers passkey_query/get/create/result/cancel: the page's
RP ID is checked against the tab origin (no public suffixes), every request
waits for the user to approve it in the app, and the extension polls for the
result. Tags are normalised on save and included in item summaries.
confirm_master_password verifies the user where there are no biometrics.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/kv-model/src/lib.rs

@@ -7,5 +7,7 @@ pub mod matching;
 pub mod passkey;
 pub mod totp;
 
-pub use item::{Item, ItemKind, Passkey};
+pub use item::{normalize_tags, Item, ItemKind, Passkey, MAX_TAGS, MAX_TAG_LEN};
+#[cfg(feature = "psl")]
+pub use matching::registrable_domain;
 pub use matching::{match_url, MatchLevel};