feat(auth): add per-account X25519 identity keypair (#3)

Phase A1 of the multi-person sharing ADR
(docs/adr/multi-person-sharing.md). Each account now gets an X25519
keypair at registration: the public half stored plaintext, the private
half wrapped under the account DEK and stored as opaque ciphertext. The
keypair is generated client-side; the backend adds no crypto deps and
stores everything verbatim, preserving the zero-knowledge contract.

This change only introduces the keypair and threads it through the auth
flows — it is not consumed yet. It unblocks Phase B (profile sharing)
without touching the data model or the ~11 frontend encrypt call sites,
which is Phase A2 (per-profile DEKs).

Backend:
- User model: identity_public_key, identity_private_key_wrapped{,_iv}
  (all Option<String>, backward compatible).
- RegisterRequest/AuthResponse carry the 3 fields; register + login
  echo them. No changes to change_password/recover (DEK value is
  unchanged across both, so the wrapped private key is too).
- 2 new integration tests: round-trip through register/login, and
  optional-fields backward compat.

Frontend:
- crypto/keys.ts: generateIdentityKeyPair, wrapIdentityPrivateKey,
  unwrapIdentityPrivateKey + in-memory identity store mirroring the DEK.
- types/api.ts: AuthTokens + RegisterRequest extended (removes an
  existing `as any` cast).
- useStore register/login/logout + UnlockPage unwrap the private key
  alongside the DEK.
- 3 new crypto tests (X25519 lifecycle, wrong-DEK rejection, distinct
  shared secrets); skip gracefully where the runtime lacks X25519.

Backend: cargo test + clippy green. Frontend: npm test + tsc green.

Also gitignore .zcode/ (local tooling artifact).

backend/tests/auth_tests.rs

@@ -287,6 +287,80 @@ async fn password_change_invalidates_existing_tokens() {
     common::drop_test_db(&db_name).await;
 }
 
+#[tokio::test]
+async fn identity_keypair_round_trips_through_register_and_login() {
+    // Phase A1 (#3): the X25519 identity keypair fields (public plaintext,
+    // private wrapped under the account DEK) are stored verbatim at register
+    // and echoed back on login. The server never inspects or derives them.
+    let (app, db_name) = require_app!(common::app_for_test().await);
+    let email = unique_email();
+
+    // Opaque blobs — the server treats these as base64 strings, nothing more.
+    let public_key = "base64-x25519-public-key-for-test";
+    let priv_wrapped = "base64-wrapped-priv-ciphertext";
+    let priv_wrapped_iv = "base64-12-byte-iv";
+
+    let (status, body) = common::send_json(
+        &app,
+        "POST",
+        "/api/auth/register",
+        Some(json!({
+            "email": email,
+            "username": "tester",
+            "password": "supersecret",
+            "identity_public_key": public_key,
+            "identity_private_key_wrapped": priv_wrapped,
+            "identity_private_key_wrapped_iv": priv_wrapped_iv,
+        })),
+        None,
+    )
+    .await;
+    assert_eq!(status, 201, "register should return 201, body: {body}");
+    assert_eq!(body["identity_public_key"], public_key);
+    assert_eq!(body["identity_private_key_wrapped"], priv_wrapped);
+    assert_eq!(body["identity_private_key_wrapped_iv"], priv_wrapped_iv);
+
+    // Login must echo the same stored values.
+    let (status, body) = common::send_json(
+        &app,
+        "POST",
+        "/api/auth/login",
+        Some(json!({ "email": email, "password": "supersecret" })),
+        None,
+    )
+    .await;
+    assert_eq!(status, 200, "login should return 200, body: {body}");
+    assert_eq!(body["identity_public_key"], public_key);
+    assert_eq!(body["identity_private_key_wrapped"], priv_wrapped);
+    assert_eq!(body["identity_private_key_wrapped_iv"], priv_wrapped_iv);
+
+    common::drop_test_db(&db_name).await;
+}
+
+#[tokio::test]
+async fn register_without_identity_keypair_stays_optional() {
+    // Backward compat: existing clients that don't send identity fields must
+    // still register successfully, and the fields are absent from the response.
+    let (app, db_name) = require_app!(common::app_for_test().await);
+    let email = unique_email();
+
+    let (status, body) = common::send_json(
+        &app,
+        "POST",
+        "/api/auth/register",
+        Some(json!({ "email": email, "username": "tester", "password": "supersecret" })),
+        None,
+    )
+    .await;
+    assert_eq!(status, 201, "register should return 201, body: {body}");
+    assert!(
+        body.get("identity_public_key").is_none() || body["identity_public_key"].is_null(),
+        "identity_public_key should be absent when not provided: {body}"
+    );
+
+    common::drop_test_db(&db_name).await;
+}
+
 // ---- helpers ----
 
 fn unique_email() -> String {