feat: wire register to wrapped-DEK model + recovery phrase UI

Register now generates a DEK, wraps it under the password KEK and recovery KEK,
and sends all wrapped forms to the server (via setupEncryption). RegisterPage
has an optional recovery phrase field with a warning. Login unwraps the DEK
from the response via unlockWithPassword. This completes the full ZK recovery
flow end-to-end from the UI.

Verified: npm build clean, 20 tests pass.

web/normogen-web/src/store/useStore.ts

@@ -35,7 +35,7 @@ interface AuthState {
   
   // Actions
   login: (email: string, password: string) => Promise<void>;
-  register: (username: string, email: string, password: string) => Promise<void>;
+  register: (username: string, email: string, password: string, recoveryPhrase?: string) => Promise<void>;
   recover: (email: string, recoveryPhrase: string, newPassword: string) => Promise<void>;
   logout: () => Promise<void>;
   clearError: () => void;
@@ -162,19 +162,25 @@ export const useAuthStore = create<AuthState>()(
           }
         },
 
-        register: async (username: string, email: string, password: string) => {
+        register: async (username: string, email: string, password: string, recoveryPhrase?: string) => {
           set({ isLoading: true, error: null });
           try {
-            const { authSecret, encKey } = await deriveAuthAndEncKeys(password);
-            setEncKey(encKey);
-            // For now register uses the Phase 1 key derivation (no recovery phrase
-            // in the basic register flow). The wrapped-DEK recovery fields are
-            // optional on the register request.
+            // Zero-knowledge: generate a DEK, wrap it under the password KEK
+            // and (if provided) the recovery KEK. Send the wrapped forms + the
+            // recovery proof to the server; the server stores them verbatim.
+            const setup = await setupEncryption(password, recoveryPhrase);
+            setEncKey(setup.dek);
+
             const response = await apiService.register({
               username,
               email,
-              password: authSecret,
-            });
+              password: setup.authSecret,
+              wrapped_dek: setup.passwordWrappedDek.data,
+              wrapped_dek_iv: setup.passwordWrappedDek.iv,
+              recovery_wrapped_dek: setup.recoveryWrappedDek?.data,
+              recovery_wrapped_dek_iv: setup.recoveryWrappedDek?.iv,
+              recovery_phrase: setup.recoveryKekHash,
+            } as any);
             set({
               user: {
                 user_id: response.user_id,