feat(auth): add per-account X25519 identity keypair (#3)

Phase A1 of the multi-person sharing ADR
(docs/adr/multi-person-sharing.md). Each account now gets an X25519
keypair at registration: the public half stored plaintext, the private
half wrapped under the account DEK and stored as opaque ciphertext. The
keypair is generated client-side; the backend adds no crypto deps and
stores everything verbatim, preserving the zero-knowledge contract.

This change only introduces the keypair and threads it through the auth
flows — it is not consumed yet. It unblocks Phase B (profile sharing)
without touching the data model or the ~11 frontend encrypt call sites,
which is Phase A2 (per-profile DEKs).

Backend:
- User model: identity_public_key, identity_private_key_wrapped{,_iv}
  (all Option<String>, backward compatible).
- RegisterRequest/AuthResponse carry the 3 fields; register + login
  echo them. No changes to change_password/recover (DEK value is
  unchanged across both, so the wrapped private key is too).
- 2 new integration tests: round-trip through register/login, and
  optional-fields backward compat.

Frontend:
- crypto/keys.ts: generateIdentityKeyPair, wrapIdentityPrivateKey,
  unwrapIdentityPrivateKey + in-memory identity store mirroring the DEK.
- types/api.ts: AuthTokens + RegisterRequest extended (removes an
  existing `as any` cast).
- useStore register/login/logout + UnlockPage unwrap the private key
  alongside the DEK.
- 3 new crypto tests (X25519 lifecycle, wrong-DEK rejection, distinct
  shared secrets); skip gracefully where the runtime lacks X25519.

Backend: cargo test + clippy green. Frontend: npm test + tsc green.

Also gitignore .zcode/ (local tooling artifact).

backend/src/handlers/auth.rs

@@ -27,6 +27,11 @@ pub struct RegisterRequest {
     /// Wrapped DEK (base64 ciphertext) — encrypted under the recovery KEK
     pub recovery_wrapped_dek: Option<String>,
     pub recovery_wrapped_dek_iv: Option<String>,
+    /// Account X25519 identity public key (base64 raw). Plaintext.
+    pub identity_public_key: Option<String>,
+    /// Account X25519 identity private key, wrapped under the account DEK.
+    pub identity_private_key_wrapped: Option<String>,
+    pub identity_private_key_wrapped_iv: Option<String>,
 }
 
 #[derive(Debug, Serialize)]
@@ -40,6 +45,12 @@ pub struct AuthResponse {
     /// user has no wrapped DEK (legacy/pre-recovery accounts).
     pub wrapped_dek: Option<String>,
     pub wrapped_dek_iv: Option<String>,
+    /// Account X25519 identity keypair. The public key is plaintext; the
+    /// private key is an opaque ciphertext blob wrapped under the account DEK.
+    /// Absent for accounts that predate the identity-keypair feature.
+    pub identity_public_key: Option<String>,
+    pub identity_private_key_wrapped: Option<String>,
+    pub identity_private_key_wrapped_iv: Option<String>,
 }
 
 pub async fn register(
@@ -108,6 +119,11 @@ pub async fn register(
     user.recovery_wrapped_dek = req.recovery_wrapped_dek.clone();
     user.recovery_wrapped_dek_iv = req.recovery_wrapped_dek_iv.clone();
     user.recovery_enabled = req.recovery_wrapped_dek.is_some();
+    // Store the X25519 identity keypair (public plaintext, private wrapped
+    // under the account DEK — server stores verbatim, cannot decrypt).
+    user.identity_public_key = req.identity_public_key;
+    user.identity_private_key_wrapped = req.identity_private_key_wrapped;
+    user.identity_private_key_wrapped_iv = req.identity_private_key_wrapped_iv;
 
     // Get token_version before saving
     let token_version = user.token_version;
@@ -203,6 +219,9 @@ pub async fn register(
         username: user.username.clone(),
         wrapped_dek: user.wrapped_dek.clone(),
         wrapped_dek_iv: user.wrapped_dek_iv.clone(),
+        identity_public_key: user.identity_public_key.clone(),
+        identity_private_key_wrapped: user.identity_private_key_wrapped.clone(),
+        identity_private_key_wrapped_iv: user.identity_private_key_wrapped_iv.clone(),
     };
 
     (StatusCode::CREATED, Json(response)).into_response()
@@ -413,6 +432,9 @@ pub async fn login(
         username: user.username.clone(),
         wrapped_dek: user.wrapped_dek.clone(),
         wrapped_dek_iv: user.wrapped_dek_iv.clone(),
+        identity_public_key: user.identity_public_key.clone(),
+        identity_private_key_wrapped: user.identity_private_key_wrapped.clone(),
+        identity_private_key_wrapped_iv: user.identity_private_key_wrapped_iv.clone(),
     };
 
     (StatusCode::OK, Json(response)).into_response()

backend/src/models/user.rs

@@ -37,6 +37,21 @@ pub struct User {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub recovery_wrapped_dek_iv: Option<String>,
 
+    /// Account X25519 identity public key (base64 raw). Plaintext — public keys
+    /// are not secret. Other accounts wrap profile DEKs to this key (Phase B,
+    /// see docs/adr/multi-person-sharing.md). Generated client-side at
+    /// registration.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub identity_public_key: Option<String>,
+
+    /// Account X25519 identity private key, wrapped (AES-256-GCM encrypted)
+    /// under the account DEK. The server stores this verbatim and cannot
+    /// decrypt it. The client unwraps it at login after unwrapping the DEK.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub identity_private_key_wrapped: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub identity_private_key_wrapped_iv: Option<String>,
+
     /// Token version for invalidating all tokens on password change
     pub token_version: i32,
 
@@ -93,6 +108,9 @@ impl User {
             wrapped_dek_iv: None,
             recovery_wrapped_dek: None,
             recovery_wrapped_dek_iv: None,
+            identity_public_key: None,
+            identity_private_key_wrapped: None,
+            identity_private_key_wrapped_iv: None,
             token_version: 0,
             created_at: now,
             last_active: now,

backend/tests/auth_tests.rs

@@ -287,6 +287,80 @@ async fn password_change_invalidates_existing_tokens() {
     common::drop_test_db(&db_name).await;
 }
 
+#[tokio::test]
+async fn identity_keypair_round_trips_through_register_and_login() {
+    // Phase A1 (#3): the X25519 identity keypair fields (public plaintext,
+    // private wrapped under the account DEK) are stored verbatim at register
+    // and echoed back on login. The server never inspects or derives them.
+    let (app, db_name) = require_app!(common::app_for_test().await);
+    let email = unique_email();
+
+    // Opaque blobs — the server treats these as base64 strings, nothing more.
+    let public_key = "base64-x25519-public-key-for-test";
+    let priv_wrapped = "base64-wrapped-priv-ciphertext";
+    let priv_wrapped_iv = "base64-12-byte-iv";
+
+    let (status, body) = common::send_json(
+        &app,
+        "POST",
+        "/api/auth/register",
+        Some(json!({
+            "email": email,
+            "username": "tester",
+            "password": "supersecret",
+            "identity_public_key": public_key,
+            "identity_private_key_wrapped": priv_wrapped,
+            "identity_private_key_wrapped_iv": priv_wrapped_iv,
+        })),
+        None,
+    )
+    .await;
+    assert_eq!(status, 201, "register should return 201, body: {body}");
+    assert_eq!(body["identity_public_key"], public_key);
+    assert_eq!(body["identity_private_key_wrapped"], priv_wrapped);
+    assert_eq!(body["identity_private_key_wrapped_iv"], priv_wrapped_iv);
+
+    // Login must echo the same stored values.
+    let (status, body) = common::send_json(
+        &app,
+        "POST",
+        "/api/auth/login",
+        Some(json!({ "email": email, "password": "supersecret" })),
+        None,
+    )
+    .await;
+    assert_eq!(status, 200, "login should return 200, body: {body}");
+    assert_eq!(body["identity_public_key"], public_key);
+    assert_eq!(body["identity_private_key_wrapped"], priv_wrapped);
+    assert_eq!(body["identity_private_key_wrapped_iv"], priv_wrapped_iv);
+
+    common::drop_test_db(&db_name).await;
+}
+
+#[tokio::test]
+async fn register_without_identity_keypair_stays_optional() {
+    // Backward compat: existing clients that don't send identity fields must
+    // still register successfully, and the fields are absent from the response.
+    let (app, db_name) = require_app!(common::app_for_test().await);
+    let email = unique_email();
+
+    let (status, body) = common::send_json(
+        &app,
+        "POST",
+        "/api/auth/register",
+        Some(json!({ "email": email, "username": "tester", "password": "supersecret" })),
+        None,
+    )
+    .await;
+    assert_eq!(status, 201, "register should return 201, body: {body}");
+    assert!(
+        body.get("identity_public_key").is_none() || body["identity_public_key"].is_null(),
+        "identity_public_key should be absent when not provided: {body}"
+    );
+
+    common::drop_test_db(&db_name).await;
+}
+
 // ---- helpers ----
 
 fn unique_email() -> String {