feat(auth): add per-account X25519 identity keypair (#3)

Phase A1 of the multi-person sharing ADR
(docs/adr/multi-person-sharing.md). Each account now gets an X25519
keypair at registration: the public half stored plaintext, the private
half wrapped under the account DEK and stored as opaque ciphertext. The
keypair is generated client-side; the backend adds no crypto deps and
stores everything verbatim, preserving the zero-knowledge contract.

This change only introduces the keypair and threads it through the auth
flows — it is not consumed yet. It unblocks Phase B (profile sharing)
without touching the data model or the ~11 frontend encrypt call sites,
which is Phase A2 (per-profile DEKs).

Backend:
- User model: identity_public_key, identity_private_key_wrapped{,_iv}
  (all Option<String>, backward compatible).
- RegisterRequest/AuthResponse carry the 3 fields; register + login
  echo them. No changes to change_password/recover (DEK value is
  unchanged across both, so the wrapped private key is too).
- 2 new integration tests: round-trip through register/login, and
  optional-fields backward compat.

Frontend:
- crypto/keys.ts: generateIdentityKeyPair, wrapIdentityPrivateKey,
  unwrapIdentityPrivateKey + in-memory identity store mirroring the DEK.
- types/api.ts: AuthTokens + RegisterRequest extended (removes an
  existing `as any` cast).
- useStore register/login/logout + UnlockPage unwrap the private key
  alongside the DEK.
- 3 new crypto tests (X25519 lifecycle, wrong-DEK rejection, distinct
  shared secrets); skip gracefully where the runtime lacks X25519.

Backend: cargo test + clippy green. Frontend: npm test + tsc green.

Also gitignore .zcode/ (local tooling artifact).

backend/src/handlers/auth.rs

@@ -27,6 +27,11 @@ pub struct RegisterRequest {
     /// Wrapped DEK (base64 ciphertext) — encrypted under the recovery KEK
     pub recovery_wrapped_dek: Option<String>,
     pub recovery_wrapped_dek_iv: Option<String>,
+    /// Account X25519 identity public key (base64 raw). Plaintext.
+    pub identity_public_key: Option<String>,
+    /// Account X25519 identity private key, wrapped under the account DEK.
+    pub identity_private_key_wrapped: Option<String>,
+    pub identity_private_key_wrapped_iv: Option<String>,
 }
 
 #[derive(Debug, Serialize)]
@@ -40,6 +45,12 @@ pub struct AuthResponse {
     /// user has no wrapped DEK (legacy/pre-recovery accounts).
     pub wrapped_dek: Option<String>,
     pub wrapped_dek_iv: Option<String>,
+    /// Account X25519 identity keypair. The public key is plaintext; the
+    /// private key is an opaque ciphertext blob wrapped under the account DEK.
+    /// Absent for accounts that predate the identity-keypair feature.
+    pub identity_public_key: Option<String>,
+    pub identity_private_key_wrapped: Option<String>,
+    pub identity_private_key_wrapped_iv: Option<String>,
 }
 
 pub async fn register(
@@ -108,6 +119,11 @@ pub async fn register(
     user.recovery_wrapped_dek = req.recovery_wrapped_dek.clone();
     user.recovery_wrapped_dek_iv = req.recovery_wrapped_dek_iv.clone();
     user.recovery_enabled = req.recovery_wrapped_dek.is_some();
+    // Store the X25519 identity keypair (public plaintext, private wrapped
+    // under the account DEK — server stores verbatim, cannot decrypt).
+    user.identity_public_key = req.identity_public_key;
+    user.identity_private_key_wrapped = req.identity_private_key_wrapped;
+    user.identity_private_key_wrapped_iv = req.identity_private_key_wrapped_iv;
 
     // Get token_version before saving
     let token_version = user.token_version;
@@ -203,6 +219,9 @@ pub async fn register(
         username: user.username.clone(),
         wrapped_dek: user.wrapped_dek.clone(),
         wrapped_dek_iv: user.wrapped_dek_iv.clone(),
+        identity_public_key: user.identity_public_key.clone(),
+        identity_private_key_wrapped: user.identity_private_key_wrapped.clone(),
+        identity_private_key_wrapped_iv: user.identity_private_key_wrapped_iv.clone(),
     };
 
     (StatusCode::CREATED, Json(response)).into_response()
@@ -413,6 +432,9 @@ pub async fn login(
         username: user.username.clone(),
         wrapped_dek: user.wrapped_dek.clone(),
         wrapped_dek_iv: user.wrapped_dek_iv.clone(),
+        identity_public_key: user.identity_public_key.clone(),
+        identity_private_key_wrapped: user.identity_private_key_wrapped.clone(),
+        identity_private_key_wrapped_iv: user.identity_private_key_wrapped_iv.clone(),
     };
 
     (StatusCode::OK, Json(response)).into_response()

backend/src/models/user.rs

@@ -37,6 +37,21 @@ pub struct User {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub recovery_wrapped_dek_iv: Option<String>,
 
+    /// Account X25519 identity public key (base64 raw). Plaintext — public keys
+    /// are not secret. Other accounts wrap profile DEKs to this key (Phase B,
+    /// see docs/adr/multi-person-sharing.md). Generated client-side at
+    /// registration.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub identity_public_key: Option<String>,
+
+    /// Account X25519 identity private key, wrapped (AES-256-GCM encrypted)
+    /// under the account DEK. The server stores this verbatim and cannot
+    /// decrypt it. The client unwraps it at login after unwrapping the DEK.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub identity_private_key_wrapped: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub identity_private_key_wrapped_iv: Option<String>,
+
     /// Token version for invalidating all tokens on password change
     pub token_version: i32,
 
@@ -93,6 +108,9 @@ impl User {
             wrapped_dek_iv: None,
             recovery_wrapped_dek: None,
             recovery_wrapped_dek_iv: None,
+            identity_public_key: None,
+            identity_private_key_wrapped: None,
+            identity_private_key_wrapped_iv: None,
             token_version: 0,
             created_at: now,
             last_active: now,