feat: zero-knowledge recovery (Phase 2) — wrapped-DEK model

Introduces a wrapped-DEK recovery model so a forgotten password doesn't lose
all encrypted data. The encryption key becomes a random DEK (not derived from
the password); the DEK is wrapped under both a password-derived KEK and a
recovery-phrase-derived KEK, and both wrapped forms are stored on the server.

Crypto (crypto/keys.ts):
- DEK generation (random AES-256-GCM), KEK derivation (PBKDF2 password/recovery),
  wrapDek/unwrapDek/rewrapDek.
- setupEncryption(password, recoveryPhrase?) — generates a DEK, wraps under both
  KEKs, returns wrapped forms + recovery proof.
- unlockWithPassword(password, wrappedDek) — derives password KEK, unwraps DEK.
- unlockWithRecovery(phrase, wrappedDek) — derives recovery KEK, unwraps DEK.

Backend:
- User model: wrapped_dek, wrapped_dek_iv, recovery_wrapped_dek,
  recovery_wrapped_dek_iv fields.
- RegisterRequest accepts wrapped-DEK fields; stored verbatim.
- AuthResponse returns wrapped_dek + wrapped_dek_iv (for login unwrapping).
- New GET /api/auth/recovery-info?email= — returns recovery-wrapped DEK.
- RecoverPasswordRequest gains new_wrapped_dek + new_wrapped_dek_iv.
- change-password also accepts + stores re-wrapped DEK.

Frontend:
- Auth store: login unwraps DEK from response; new recover() action fetches
  recovery-wrapped DEK, unwraps with phrase, re-wraps under new password.
- RecoveryPage (new): email + recovery phrase + new password flow.
- LoginPage: 'Forgot password? Recover' link. App.tsx: /recover route.

Verified: backend 21 tests, 0 warnings; frontend build clean, 20 tests.

backend/src/models/user.rs

@@ -23,6 +23,20 @@ pub struct User {
     /// Whether password recovery is enabled for this user
     pub recovery_enabled: bool,
 
+    /// Wrapped DEK (data encryption key) — the DEK encrypted under the password
+    /// KEK. Base64 ciphertext. The server stores this verbatim; only the client
+    /// can unwrap it. (Phase 2 zero-knowledge recovery.)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub wrapped_dek: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub wrapped_dek_iv: Option<String>,
+
+    /// Wrapped DEK under the recovery KEK — for password recovery.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub recovery_wrapped_dek: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub recovery_wrapped_dek_iv: Option<String>,
+
     /// Token version for invalidating all tokens on password change
     pub token_version: i32,
 
@@ -75,6 +89,10 @@ impl User {
             password_hash,
             recovery_phrase_hash,
             recovery_enabled,
+            wrapped_dek: None,
+            wrapped_dek_iv: None,
+            recovery_wrapped_dek: None,
+            recovery_wrapped_dek_iv: None,
             token_version: 0,
             created_at: now,
             last_active: now,