Browser bridge in the core (shared by the Mac and desktop apps); webpki security update

- crates/kv-ipc: native-messaging framing and the local IPC socket/pipe (moved from kestrove-desktop),
  plus Listener::bind_in/connect_in and, on macOS, the App Group socket for the kestrove-nmh bundled
  in Kestrove.app (Contents/Resources/kestrove-app-group).
- crates/kv-nmh: the native-messaging host, with an embedded Info.plist on macOS so it can run
  sandboxed (KV_NMH_BUNDLE_ID).
- kv-ffi feature browser-bridge: broker, pairing channel and word list (moved from kestrove-desktop)
  and BrowserBridge for Swift. build-apple.sh enables it and builds a universal kestrove-nmh.
- RUSTSEC-2026-0381/0382: rustls-webpki 0.103.16, webpki-roots 1.0.10 (distrusted emSign roots).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/kv-nmh/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "kv-nmh"
+description = "Native messaging host for the browser extension: relays encrypted frames to the running app."
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+
+[[bin]]
+name = "kestrove-nmh"
+path = "src/main.rs"
+
+[dependencies]
+kv-ipc = { path = "../kv-ipc" }
+serde_json.workspace = true