Add kv-wasm: the core compiled to WebAssembly for the web vault

New crate crates/kv-wasm runs the same crypto, item model and sync engine in the browser:
- WebStore: in-memory replica of kv-store's Store, each changed entry written to IndexedDB
  (ciphertext only) before the JS call resolves.
- Device key: non-extractable WebCrypto ECDSA P-256 key in IndexedDB (raw r||s signatures).
- WebCore mirrors kv-ffi's VaultCore; wasm-bindgen surface in camelCase with TypeScript types,
  plus a Web Worker wrapper (connectVault) so Argon2id never blocks the page.
- Tests: Chrome (IndexedDB, WebCrypto, RFC 9421 verify), shared envelope fixtures both ways
  with kv-ffi, native sync with kv-ffi via the test server, Node smoke of the built package.

Small changes to shared crates so they build for wasm32:
- kv-store: SqliteStore moved to a native-only module.
- kv-sync: rustls/pinning/tokio native only (fetch on wasm); DeviceSigner::sign_async (default
  wraps sign) used by ApiClient; unix_now() instead of SystemTime/now_utc.
- kv-model: Public Suffix List behind a default `psl` feature (kv-ffi keeps it; the web build
  drops ~0.9 MB of code and matches same-host only).
- wasm-release profile (opt-level z, Argon2 at 3) and a wasm CI job.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/kv-wasm/src/dto.rs

@@ -0,0 +1,180 @@
+//! Records crossing the JS boundary. Same fields as kv-ffi's UniFFI records, in camelCase; enums are
+//! camelCase strings (`"login"`, `"secureNote"`, `"pendingApproval"`); byte fields are `Uint8Array`.
+//! The TypeScript declarations for these live in `wasm.rs` (`TS_TYPES`); keep both in step.
+
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum ItemKindDto {
+    Login,
+    SecureNote,
+    Card,
+    Identity,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum MatchLevelDto {
+    None,
+    Domain,
+    Host,
+    Exact,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum PlatformDto {
+    Ios,
+    Macos,
+    Android,
+    Windows,
+    Linux,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ItemSummary {
+    pub id: String,
+    pub kind: ItemKindDto,
+    pub title: String,
+    pub username: Option<String>,
+    pub urls: Vec<String>,
+    pub favorite: bool,
+    pub has_totp: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ItemDto {
+    /// Empty string means "new item".
+    #[serde(default)]
+    pub id: String,
+    pub kind: ItemKindDto,
+    pub title: String,
+    #[serde(default)]
+    pub username: Option<String>,
+    #[serde(default)]
+    pub password: Option<String>,
+    #[serde(default)]
+    pub urls: Vec<String>,
+    #[serde(default)]
+    pub totp: Option<String>,
+    #[serde(default)]
+    pub notes: Option<String>,
+    #[serde(default)]
+    pub favorite: bool,
+    #[serde(default)]
+    pub tags: Vec<String>,
+    #[serde(default)]
+    pub modified_at: i64,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct TotpCode {
+    pub code: String,
+    pub seconds_remaining: u64,
+    pub period: u64,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ServerInfoDto {
+    pub version: String,
+    pub api: u32,
+    pub setup_open: bool,
+    pub min_client: String,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum LoginResult {
+    /// Logged in and unlocked.
+    Ok,
+    /// An enrolled device must approve this browser (or pass `totp`); call `login` again afterwards.
+    PendingApproval,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SyncReport {
+    pub pulled: u32,
+    pub pushed: u32,
+    pub merged: u32,
+    pub restored_item_ids: Vec<String>,
+    pub vaults_synced: u32,
+    pub vaults_skipped: u32,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DeviceDto {
+    pub device_id: String,
+    pub name: String,
+    pub platform: PlatformDto,
+    pub approved: bool,
+    pub revoked: bool,
+    pub current: bool,
+    pub created_at: String,
+    pub key_fingerprint: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PasskeySummary {
+    pub item_id: String,
+    #[serde(with = "serde_bytes")]
+    pub credential_id: Vec<u8>,
+    pub rp_id: String,
+    #[serde(with = "serde_bytes")]
+    pub user_handle: Vec<u8>,
+    pub user_name: String,
+    pub created_at: i64,
+}
+
+/// `{ type: "onePux" } | { type: "csv" } | { type: "kestroveEncrypted", passphrase }`.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "camelCase")]
+pub enum ImportFormat {
+    OnePux,
+    Csv,
+    KestroveEncrypted { passphrase: String },
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum DuplicateHandling {
+    Skip,
+    AddSuffix,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ImportOptions {
+    pub duplicates: DuplicateHandling,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ImportPreview {
+    pub total: u32,
+    pub logins: u32,
+    pub secure_notes: u32,
+    pub cards: u32,
+    pub identities: u32,
+    pub duplicates: u32,
+    pub attachments_skipped: u32,
+    pub warnings: Vec<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ImportReport {
+    pub imported: u32,
+    pub skipped_duplicates: u32,
+    pub renamed_duplicates: u32,
+    pub attachments_skipped: u32,
+    pub warnings: Vec<String>,
+    pub item_ids: Vec<String>,
+}