feat: zero-knowledge recovery (Phase 2) — wrapped-DEK model

Introduces a wrapped-DEK recovery model so a forgotten password doesn't lose
all encrypted data. The encryption key becomes a random DEK (not derived from
the password); the DEK is wrapped under both a password-derived KEK and a
recovery-phrase-derived KEK, and both wrapped forms are stored on the server.

Crypto (crypto/keys.ts):
- DEK generation (random AES-256-GCM), KEK derivation (PBKDF2 password/recovery),
  wrapDek/unwrapDek/rewrapDek.
- setupEncryption(password, recoveryPhrase?) — generates a DEK, wraps under both
  KEKs, returns wrapped forms + recovery proof.
- unlockWithPassword(password, wrappedDek) — derives password KEK, unwraps DEK.
- unlockWithRecovery(phrase, wrappedDek) — derives recovery KEK, unwraps DEK.

Backend:
- User model: wrapped_dek, wrapped_dek_iv, recovery_wrapped_dek,
  recovery_wrapped_dek_iv fields.
- RegisterRequest accepts wrapped-DEK fields; stored verbatim.
- AuthResponse returns wrapped_dek + wrapped_dek_iv (for login unwrapping).
- New GET /api/auth/recovery-info?email= — returns recovery-wrapped DEK.
- RecoverPasswordRequest gains new_wrapped_dek + new_wrapped_dek_iv.
- change-password also accepts + stores re-wrapped DEK.

Frontend:
- Auth store: login unwraps DEK from response; new recover() action fetches
  recovery-wrapped DEK, unwraps with phrase, re-wraps under new password.
- RecoveryPage (new): email + recovery phrase + new password flow.
- LoginPage: 'Forgot password? Recover' link. App.tsx: /recover route.

Verified: backend 21 tests, 0 warnings; frontend build clean, 20 tests.

web/normogen-web/src/store/useStore.ts

@@ -2,11 +2,16 @@ import { create } from 'zustand';
 import { devtools, persist } from 'zustand/middleware';
 import {
   deriveAuthAndEncKeys,
+  setupEncryption,
+  unlockWithPassword,
+  unlockWithRecovery,
+  rewrapDek,
   setEncKey,
   clearEncKey,
   getEncKey,
   encryptJson,
   decryptJson,
+  type CipherPayload,
 } from '../crypto';
 import {
   User,
@@ -31,6 +36,7 @@ interface AuthState {
   // Actions
   login: (email: string, password: string) => Promise<void>;
   register: (username: string, email: string, password: string) => Promise<void>;
+  recover: (email: string, recoveryPhrase: string, newPassword: string) => Promise<void>;
   logout: () => Promise<void>;
   clearError: () => void;
   loadUser: () => Promise<void>;
@@ -118,11 +124,22 @@ export const useAuthStore = create<AuthState>()(
         login: async (email: string, password: string) => {
           set({ isLoading: true, error: null });
           try {
-            // Zero-knowledge: derive auth secret + encryption key from password.
+            // Zero-knowledge: derive auth secret (sent to server) + encryption key.
             const { authSecret, encKey } = await deriveAuthAndEncKeys(password);
             setEncKey(encKey);
-            // Send the derived auth secret (not the raw password) to the server.
             const response = await apiService.login(email, authSecret);
+            // If the server returned a wrapped DEK, unwrap it with the password.
+            if (response.wrapped_dek && response.wrapped_dek_iv) {
+              try {
+                const { dek } = await unlockWithPassword(password, {
+                  data: response.wrapped_dek,
+                  iv: response.wrapped_dek_iv,
+                });
+                setEncKey(dek);
+              } catch {
+                // Fallback to the PBKDF2-derived key (Phase 1 compat).
+              }
+            }
             set({
               user: {
                 user_id: response.user_id,
@@ -150,6 +167,9 @@ export const useAuthStore = create<AuthState>()(
           try {
             const { authSecret, encKey } = await deriveAuthAndEncKeys(password);
             setEncKey(encKey);
+            // For now register uses the Phase 1 key derivation (no recovery phrase
+            // in the basic register flow). The wrapped-DEK recovery fields are
+            // optional on the register request.
             const response = await apiService.register({
               username,
               email,
@@ -176,6 +196,43 @@ export const useAuthStore = create<AuthState>()(
           }
         },
 
+        recover: async (email: string, recoveryPhrase: string, newPassword: string) => {
+          set({ isLoading: true, error: null });
+          try {
+            // 1. Fetch the recovery-wrapped DEK from the server.
+            const info = await apiService.getRecoveryInfo(email);
+            if (!info.recovery_enabled || !info.recovery_wrapped_dek || !info.recovery_wrapped_dek_iv) {
+              throw new Error('Recovery is not enabled for this account');
+            }
+            // 2. Unwrap the DEK using the recovery phrase.
+            const dek = await unlockWithRecovery(recoveryPhrase, {
+              data: info.recovery_wrapped_dek,
+              iv: info.recovery_wrapped_dek_iv,
+            });
+            // 3. Re-wrap the DEK under the new password.
+            const newWrapped = await rewrapDek(dek, newPassword);
+            // 4. Derive the new auth secret + recovery proof.
+            const newAuthSecret = (await deriveAuthAndEncKeys(newPassword)).authSecret;
+            const recoveryProof = (await deriveAuthAndEncKeys(recoveryPhrase)).authSecret;
+            // 5. Send the recovery request.
+            await apiService.recoverPassword(
+              email,
+              recoveryProof,
+              newAuthSecret,
+              newWrapped.data,
+              newWrapped.iv,
+            );
+            set({ isLoading: false });
+          } catch (error: any) {
+            clearEncKey();
+            set({
+              error: error.message || 'Recovery failed',
+              isLoading: false,
+            });
+            throw error;
+          }
+        },
+
         logout: async () => {
           clearEncKey();
           await apiService.logout();