Browser bridge in the core (shared by the Mac and desktop apps); webpki security update

- crates/kv-ipc: native-messaging framing and the local IPC socket/pipe (moved from kestrove-desktop),
  plus Listener::bind_in/connect_in and, on macOS, the App Group socket for the kestrove-nmh bundled
  in Kestrove.app (Contents/Resources/kestrove-app-group).
- crates/kv-nmh: the native-messaging host, with an embedded Info.plist on macOS so it can run
  sandboxed (KV_NMH_BUNDLE_ID).
- kv-ffi feature browser-bridge: broker, pairing channel and word list (moved from kestrove-desktop)
  and BrowserBridge for Swift. build-apple.sh enables it and builds a universal kestrove-nmh.
- RUSTSEC-2026-0381/0382: rustls-webpki 0.103.16, webpki-roots 1.0.10 (distrusted emSign roots).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Cargo.lock

@@ -1313,11 +1313,14 @@ dependencies = [
 name = "kv-ffi"
 version = "0.1.0"
 dependencies = [
+ "aes-gcm",
  "base64 0.22.1",
  "ciborium",
+ "getrandom 0.2.17",
  "hkdf",
  "kv-crypto",
  "kv-import",
+ "kv-ipc",
  "kv-model",
  "kv-proto",
  "kv-store",
@@ -1330,7 +1333,9 @@ dependencies = [
  "thiserror",
  "tokio",
  "uniffi",
+ "url",
  "uuid",
+ "x25519-dalek",
  "zeroize",
  "zip",
 ]
@@ -1355,6 +1360,16 @@ dependencies = [
  "zip",
 ]
 
+[[package]]
+name = "kv-ipc"
+version = "0.1.0"
+dependencies = [
+ "libc",
+ "serde_json",
+ "tempfile",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "kv-model"
 version = "0.1.0"
@@ -1375,6 +1390,14 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "kv-nmh"
+version = "0.1.0"
+dependencies = [
+ "kv-ipc",
+ "serde_json",
+]
+
 [[package]]
 name = "kv-proto"
 version = "0.1.0"
@@ -1430,7 +1453,7 @@ dependencies = [
  "tokio-rustls",
  "url",
  "uuid",
- "webpki-roots 0.26.11",
+ "webpki-roots",
  "wiremock",
  "zeroize",
 ]
@@ -2024,9 +2047,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.15"
+version = "0.103.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -2949,18 +2972,9 @@ dependencies = [
 
 [[package]]
 name = "webpki-roots"
-version = "0.26.11"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
-dependencies = [
- "webpki-roots 1.0.9",
-]
-
-[[package]]
-name = "webpki-roots"
-version = "1.0.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
+checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -3117,6 +3131,8 @@ checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
 dependencies = [
  "curve25519-dalek",
  "rand_core",
+ "serde",
+ "zeroize",
 ]
 
 [[package]]