Add kv-wasm: the core compiled to WebAssembly for the web vault

New crate crates/kv-wasm runs the same crypto, item model and sync engine in the browser:
- WebStore: in-memory replica of kv-store's Store, each changed entry written to IndexedDB
  (ciphertext only) before the JS call resolves.
- Device key: non-extractable WebCrypto ECDSA P-256 key in IndexedDB (raw r||s signatures).
- WebCore mirrors kv-ffi's VaultCore; wasm-bindgen surface in camelCase with TypeScript types,
  plus a Web Worker wrapper (connectVault) so Argon2id never blocks the page.
- Tests: Chrome (IndexedDB, WebCrypto, RFC 9421 verify), shared envelope fixtures both ways
  with kv-ffi, native sync with kv-ffi via the test server, Node smoke of the built package.

Small changes to shared crates so they build for wasm32:
- kv-store: SqliteStore moved to a native-only module.
- kv-sync: rustls/pinning/tokio native only (fetch on wasm); DeviceSigner::sign_async (default
  wraps sign) used by ApiClient; unix_now() instead of SystemTime/now_utc.
- kv-model: Public Suffix List behind a default `psl` feature (kv-ffi keeps it; the web build
  drops ~0.9 MB of code and matches same-host only).
- wasm-release profile (opt-level z, Argon2 at 3) and a wasm CI job.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/kv-sync/Cargo.toml

@@ -21,10 +21,6 @@ rand_core.workspace = true
 zeroize.workspace = true
 opaque-ke.workspace = true
 reqwest.workspace = true
-rustls.workspace = true
-webpki-roots.workspace = true
-rustls-webpki.workspace = true
-tokio.workspace = true
 ciborium.workspace = true
 blake3.workspace = true
 p256.workspace = true
@@ -32,6 +28,17 @@ time.workspace = true
 url.workspace = true
 wiremock = { workspace = true, optional = true }
 
+# Native transport: rustls with SPKI pinning. In the browser (wasm32) reqwest uses fetch and the
+# browser's TLS, so none of this applies there.
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+rustls.workspace = true
+webpki-roots.workspace = true
+rustls-webpki.workspace = true
+tokio.workspace = true
+
+[target.'cfg(target_arch = "wasm32")'.dependencies]
+js-sys = "0.3"
+
 [features]
 # In-memory fake of kestrove-server for tests (also used by kv-ffi's tests).
 test-server = ["dep:wiremock"]