Sync with the server and scan-to-join onboarding

- Device key (DeviceSigner): Windows TPM via CNG with a DPAPI-sealed software
  fallback, Linux Secret Service with a 0600 file fallback (warned in Settings),
  macOS keychain for dev runs. The store used is recorded; no silent switching.
- SyncService (Tauri-free): server URL and pins, create account with the
  server's setup code, sync after unlock/save/browser save, every 15 min while
  unlocked and on demand, status events, integrity alarm, device list with
  fingerprint approval and revoke.
- Onboarding: "Use my phone" (join_start/poll, QR rendered locally, 6-digit
  code), Emergency Kit from PDF/PNG/JPEG (hayro + rqrr), paste setup code, new
  account. Then only the master password.
- From a signed-in desktop: "Add a phone or tablet" QR with countdown (cancel,
  lock and quit revoke the ticket) and "Approve a computer" via pasted join code.
- KESTROVE_DATA_DIR / KESTROVE_DEVICE_NAME for a second instance; ignored
  live test drives three instances against a real server.
- deny: ignore three unmaintained notices for zbus 5 sub-crates (Linux keyring).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src-tauri/Cargo.toml

@@ -40,12 +40,25 @@ base64 = "0.22"
 uuid = { version = "1", features = ["v4"] }
 url = "2"
 zeroize = "1"
+# Device key (docs/03 "Device keys"): P-256 software key where no hardware key is available.
+p256 = { version = "0.13", features = ["ecdsa"] }
+# Onboarding (docs/10): render QR codes locally, read the Emergency Kit QR from an image or a PDF.
+qrcode = { version = "0.14", default-features = false, features = ["svg"] }
+rqrr = { version = "0.11", default-features = false }
+image = { version = "0.25", default-features = false, features = ["png", "jpeg"] }
+hayro = { version = "0.8", default-features = false }
+tokio = { version = "1", features = ["time", "sync", "macros"] }
 
 [target.'cfg(unix)'.dependencies]
 libc = "0.2"
 
+# macOS (dev) keychain / Linux Secret Service for the device key. Windows uses CNG (TPM) or DPAPI instead.
+[target.'cfg(not(windows))'.dependencies]
+keyring = "4"
+
 [target.'cfg(windows)'.dependencies]
 windows-sys = { version = "0.61", features = [
+  "Win32_Security_Cryptography",
   "Win32_Foundation",
   "Win32_Security",
   "Win32_Security_Authorization",
@@ -63,6 +76,7 @@ core-foundation = "0.10"
 
 [dev-dependencies]
 tempfile = "3"
+tokio = { version = "1", features = ["rt-multi-thread", "macros"] }
 
 [profile.release]
 lto = true