Browser bridge in the core (shared by the Mac and desktop apps); webpki security update

- crates/kv-ipc: native-messaging framing and the local IPC socket/pipe (moved from kestrove-desktop),
  plus Listener::bind_in/connect_in and, on macOS, the App Group socket for the kestrove-nmh bundled
  in Kestrove.app (Contents/Resources/kestrove-app-group).
- crates/kv-nmh: the native-messaging host, with an embedded Info.plist on macOS so it can run
  sandboxed (KV_NMH_BUNDLE_ID).
- kv-ffi feature browser-bridge: broker, pairing channel and word list (moved from kestrove-desktop)
  and BrowserBridge for Swift. build-apple.sh enables it and builds a universal kestrove-nmh.
- RUSTSEC-2026-0381/0382: rustls-webpki 0.103.16, webpki-roots 1.0.10 (distrusted emSign roots).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/kv-ffi/Cargo.toml

@@ -31,6 +31,16 @@ thiserror.workspace = true
 serde_json.workspace = true
 zeroize.workspace = true
 uniffi = { workspace = true, features = ["cli", "tokio"] }
+# browser-bridge: the app side of the browser extension protocol (pairing channel, broker, local IPC).
+kv-ipc = { path = "../kv-ipc", optional = true }
+x25519-dalek = { version = "2", features = ["static_secrets", "zeroize"], optional = true }
+aes-gcm = { version = "0.10", optional = true }
+getrandom = { version = "0.2", optional = true }
+url = { workspace = true, optional = true }
+
+[features]
+# Serves the browser extension through kestrove-nmh: on in the macOS app (via the Apple build) and the desktop app.
+browser-bridge = ["dep:kv-ipc", "dep:x25519-dalek", "dep:aes-gcm", "dep:getrandom", "dep:url", "uuid/v4"]
 
 [dev-dependencies]
 kv-sync = { workspace = true, features = ["test-server"] }