kv-sync: authenticated tombstones (sealed {id, seq, deleted: true})

Tombstones carried no ciphertext, so the server could forge a delete (hiding
an item), and a device that pulled one accepted the next live version without
a seq comparison (delete-then-replay rollback).

* A delete is sealed like an item (same AAD and padding) with plaintext
  {id, seq, deleted: true}; seq = working/base seq + 1. DELETE carries it as
  the ItemPut body; the test server stores and serves it.
* replay: Base is None | LegacyTombstone | Sealed(plaintext). check_pulled
  refuses a record without ciphertext, a deleted flag that disagrees with the
  plaintext, or a tombstone naming another item, then requires seq to grow
  for tombstones too. The `restores` exception is gone: edit beats delete
  re-seals with max(edit, tombstone) + 1. next_version returns just seq.
* Legacy: a pulled tombstone without ciphertext is an integrity alarm (cannot
  be told apart from a forgery). A pending legacy delete is sealed on push; a
  legacy tombstone already held as base is accepted as unknown seq.
* engine: open_sealed, seal_tombstone; next_local_version -> u64. Merkle leaf
  hashes a sealed tombstone's envelope like a live record's.
* kv-model Item: `restores` removed. kv-ffi delete_item seals the tombstone;
  FFI surface unchanged.
* Tests: forged (unsealed and relabelled) tombstones raise an integrity alarm
  (kv-sync and kv-ffi), replay after a tombstone, replays of the tombstone and
  of the restore, legacy pending delete, shared item_replay.json table; the
  live test now deletes an item through the real server.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/kv-model/src/item.rs

@@ -56,10 +56,6 @@ pub struct Item {
     /// versions it derives from (docs/02 "Item plaintext", docs/03 "Per-item replay protection").
     #[serde(default)]
     pub seq: u64,
-    /// Server revision of the tombstone this version was written over (edit beats delete). Only set on that
-    /// one version.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub restores: Option<u64>,
 }
 
 impl Item {
@@ -80,7 +76,6 @@ impl Item {
             created_at: now,
             modified_at: now,
             seq: 1,
-            restores: None,
         }
     }
 }