Passkeys for the browser extension, tags in item lists

The browser bridge answers passkey_query/get/create/result/cancel: the page's
RP ID is checked against the tab origin (no public suffixes), every request
waits for the user to approve it in the app, and the extension polls for the
result. Tags are normalised on save and included in item summaries.
confirm_master_password verifies the user where there are no biometrics.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/kv-wasm/src/core.rs

@@ -296,7 +296,7 @@ impl WebCore {
         model.totp = item.totp;
         model.notes = item.notes;
         model.favorite = item.favorite;
-        model.tags = item.tags;
+        model.tags = kv_model::normalize_tags(&item.tags);
         model.modified_at = now.max(previous.as_ref().map_or(0, |p| p.modified_at + 1));
         self.write_item(&acct, &u, &mut model, existing.filter(|_| previous.is_some()), false)?;
         Ok(id.to_string())