Add kv-wasm: the core compiled to WebAssembly for the web vault

New crate crates/kv-wasm runs the same crypto, item model and sync engine in the browser:
- WebStore: in-memory replica of kv-store's Store, each changed entry written to IndexedDB
  (ciphertext only) before the JS call resolves.
- Device key: non-extractable WebCrypto ECDSA P-256 key in IndexedDB (raw r||s signatures).
- WebCore mirrors kv-ffi's VaultCore; wasm-bindgen surface in camelCase with TypeScript types,
  plus a Web Worker wrapper (connectVault) so Argon2id never blocks the page.
- Tests: Chrome (IndexedDB, WebCrypto, RFC 9421 verify), shared envelope fixtures both ways
  with kv-ffi, native sync with kv-ffi via the test server, Node smoke of the built package.

Small changes to shared crates so they build for wasm32:
- kv-store: SqliteStore moved to a native-only module.
- kv-sync: rustls/pinning/tokio native only (fetch on wasm); DeviceSigner::sign_async (default
  wraps sign) used by ApiClient; unix_now() instead of SystemTime/now_utc.
- kv-model: Public Suffix List behind a default `psl` feature (kv-ffi keeps it; the web build
  drops ~0.9 MB of code and matches same-host only).
- wasm-release profile (opt-level z, Argon2 at 3) and a wasm CI job.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/kv-wasm/Cargo.toml

@@ -0,0 +1,64 @@
+[package]
+name = "kv-wasm"
+description = "WebAssembly build of the Kestrove core for the web vault (IndexedDB store, WebCrypto device key)."
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+
+[lib]
+crate-type = ["cdylib", "rlib"]
+
+[dependencies]
+kv-proto.workspace = true
+kv-crypto.workspace = true
+kv-model.workspace = true
+kv-store.workspace = true
+kv-sync.workspace = true
+kv-import.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+thiserror.workspace = true
+uuid.workspace = true
+zeroize.workspace = true
+sha2.workspace = true
+serde_bytes = "0.11"
+
+[target.'cfg(target_arch = "wasm32")'.dependencies]
+wasm-bindgen = "0.2"
+wasm-bindgen-futures = "0.4"
+js-sys = "0.3"
+serde-wasm-bindgen = "0.6"
+# Browser randomness (crypto.getRandomValues) for uuid and rand_core/OsRng.
+uuid = { workspace = true, features = ["js"] }
+getrandom = { version = "0.2", features = ["js"] }
+web-sys = { version = "0.3", features = [
+  "Crypto", "SubtleCrypto", "CryptoKey", "CryptoKeyPair", "EcKeyGenParams", "EcdsaParams",
+  "IdbFactory", "IdbDatabase", "IdbOpenDbRequest", "IdbRequest", "IdbRequestReadyState", "IdbTransaction",
+  "IdbTransactionMode", "IdbObjectStore", "IdbObjectStoreParameters", "IdbVersionChangeEvent", "IdbCursorWithValue",
+  "DomException", "DomStringList", "Window", "WorkerGlobalScope", "Event",
+] }
+
+[target.'cfg(target_arch = "wasm32")'.dev-dependencies]
+wasm-bindgen-test = "0.3"
+
+[target.'cfg(not(target_arch = "wasm32"))'.dev-dependencies]
+kv-ffi = { path = "../kv-ffi" }
+kv-store.workspace = true
+kv-sync = { workspace = true, features = ["test-server"] }
+tokio = { workspace = true }
+tempfile.workspace = true
+
+# rustc targets these post-MVP features by default; wasm-opt must be told it may use them.
+# `custom` applies to `--profile wasm-release`.
+[package.metadata.wasm-pack.profile.release]
+wasm-opt = [
+  "-Oz", "--enable-bulk-memory", "--enable-nontrapping-float-to-int", "--enable-sign-ext",
+  "--enable-mutable-globals", "--enable-reference-types", "--enable-multivalue",
+]
+
+[package.metadata.wasm-pack.profile.custom]
+wasm-opt = [
+  "-Oz", "--enable-bulk-memory", "--enable-nontrapping-float-to-int", "--enable-sign-ext",
+  "--enable-mutable-globals", "--enable-reference-types", "--enable-multivalue",
+]