kv-sync: authenticated tombstones (sealed {id, seq, deleted: true})

Tombstones carried no ciphertext, so the server could forge a delete (hiding
an item), and a device that pulled one accepted the next live version without
a seq comparison (delete-then-replay rollback).

* A delete is sealed like an item (same AAD and padding) with plaintext
  {id, seq, deleted: true}; seq = working/base seq + 1. DELETE carries it as
  the ItemPut body; the test server stores and serves it.
* replay: Base is None | LegacyTombstone | Sealed(plaintext). check_pulled
  refuses a record without ciphertext, a deleted flag that disagrees with the
  plaintext, or a tombstone naming another item, then requires seq to grow
  for tombstones too. The `restores` exception is gone: edit beats delete
  re-seals with max(edit, tombstone) + 1. next_version returns just seq.
* Legacy: a pulled tombstone without ciphertext is an integrity alarm (cannot
  be told apart from a forgery). A pending legacy delete is sealed on push; a
  legacy tombstone already held as base is accepted as unknown seq.
* engine: open_sealed, seal_tombstone; next_local_version -> u64. Merkle leaf
  hashes a sealed tombstone's envelope like a live record's.
* kv-model Item: `restores` removed. kv-ffi delete_item seals the tombstone;
  FFI surface unchanged.
* Tests: forged (unsealed and relabelled) tombstones raise an integrity alarm
  (kv-sync and kv-ffi), replay after a tombstone, replays of the tombstone and
  of the restore, legacy pending delete, shared item_replay.json table; the
  live test now deletes an item through the real server.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/kv-ffi/tests/live_server.rs

@@ -97,6 +97,16 @@ async fn two_devices_against_local_server() {
     assert_eq!((ia.notes.as_deref(), ia.username.as_deref()), (Some("A"), Some("b")));
     assert_eq!((ib.notes, ib.username), (ia.notes, ia.username));
 
+    // A delete carries the sealed tombstone, and B authenticates it.
+    let temp = a.save_item(item("Temp", "pw-t")).unwrap();
+    a.sync_now().await.unwrap();
+    b.sync_now().await.unwrap();
+    assert!(b.get_item(temp.clone()).is_ok());
+    a.delete_item(temp.clone()).unwrap();
+    assert_eq!(a.sync_now().await.unwrap().pushed, 1);
+    b.sync_now().await.unwrap();
+    assert!(matches!(b.get_item(temp), Err(CoreError::NotFound)));
+
     b.logout().await.unwrap();
     println!("live sync OK against {url}");
 }