feat(auth): add per-account X25519 identity keypair (#3)

Phase A1 of the multi-person sharing ADR
(docs/adr/multi-person-sharing.md). Each account now gets an X25519
keypair at registration: the public half stored plaintext, the private
half wrapped under the account DEK and stored as opaque ciphertext. The
keypair is generated client-side; the backend adds no crypto deps and
stores everything verbatim, preserving the zero-knowledge contract.

This change only introduces the keypair and threads it through the auth
flows — it is not consumed yet. It unblocks Phase B (profile sharing)
without touching the data model or the ~11 frontend encrypt call sites,
which is Phase A2 (per-profile DEKs).

Backend:
- User model: identity_public_key, identity_private_key_wrapped{,_iv}
  (all Option<String>, backward compatible).
- RegisterRequest/AuthResponse carry the 3 fields; register + login
  echo them. No changes to change_password/recover (DEK value is
  unchanged across both, so the wrapped private key is too).
- 2 new integration tests: round-trip through register/login, and
  optional-fields backward compat.

Frontend:
- crypto/keys.ts: generateIdentityKeyPair, wrapIdentityPrivateKey,
  unwrapIdentityPrivateKey + in-memory identity store mirroring the DEK.
- types/api.ts: AuthTokens + RegisterRequest extended (removes an
  existing `as any` cast).
- useStore register/login/logout + UnlockPage unwrap the private key
  alongside the DEK.
- 3 new crypto tests (X25519 lifecycle, wrong-DEK rejection, distinct
  shared secrets); skip gracefully where the runtime lacks X25519.

Backend: cargo test + clippy green. Frontend: npm test + tsc green.

Also gitignore .zcode/ (local tooling artifact).

web/normogen-web/src/crypto/keys.ts

@@ -185,6 +185,62 @@ export async function unlockWithRecovery(
   return unwrapDek(recoveryWrappedDek, recoveryKek);
 }
 
+// ---------------------------------------------------------------------------
+// Account X25519 identity keypair (Phase A1, multi-person sharing prep).
+//
+// Each account gets an X25519 keypair at registration. The PUBLIC half is
+// stored in plaintext (public keys are not secret); other accounts will wrap
+// profile DEKs to it in Phase B. The PRIVATE half is wrapped (AES-GCM
+// encrypted) under the account DEK and stored on the server as opaque
+// ciphertext. The server never sees the private key.
+//
+// See docs/adr/multi-person-sharing.md §1.
+// ---------------------------------------------------------------------------
+
+/** Generate an X25519 keypair for the account. Returns the public key as a
+ * base64 raw string (for the server to store) and the private key as a
+ * CryptoKey (kept in memory, wrapped before upload). */
+export async function generateIdentityKeyPair(): Promise<{
+  publicKey: string;
+  privateKey: CryptoKey;
+}> {
+  const { publicKey, privateKey } = (await crypto.subtle.generateKey(
+    { name: 'ECDH', namedCurve: 'X25519' },
+    true, // extractable so we can export the private key for wrapping
+    ['deriveBits'],
+  )) as CryptoKeyPair;
+  const rawPublic = await crypto.subtle.exportKey('raw', publicKey);
+  return { publicKey: base64(new Uint8Array(rawPublic)), privateKey };
+}
+
+/** Wrap (encrypt) the X25519 private key under the account DEK. The DEK is an
+ * AES-GCM key, so we reuse the string-cipher from cipher.ts: export the private
+ * key to raw bytes, base64-encode, and encrypt. */
+export async function wrapIdentityPrivateKey(
+  privateKey: CryptoKey,
+  dek: CryptoKey,
+): Promise<CipherPayload> {
+  const rawPrivate = await crypto.subtle.exportKey('raw', privateKey);
+  return encrypt(base64(new Uint8Array(rawPrivate)), dek);
+}
+
+/** Unwrap (decrypt) the X25519 private key from its DEK-wrapped form. Inverse
+ * of wrapIdentityPrivateKey. The result is importable for ECDH deriveBits. */
+export async function unwrapIdentityPrivateKey(
+  payload: CipherPayload,
+  dek: CryptoKey,
+): Promise<CryptoKey> {
+  const rawPrivateB64 = await decrypt(payload, dek);
+  const rawPrivate = Uint8Array.from(atob(rawPrivateB64), (c) => c.charCodeAt(0));
+  return crypto.subtle.importKey(
+    'raw',
+    rawPrivate as BufferSource,
+    { name: 'ECDH', namedCurve: 'X25519' },
+    true, // extractable so it can be re-wrapped if ever needed
+    ['deriveBits'],
+  );
+}
+
 // ---------------------------------------------------------------------------
 // In-memory key store (unchanged from Phase 1)
 // ---------------------------------------------------------------------------
@@ -207,6 +263,30 @@ export function hasEncKey(): boolean {
   return currentEncKey !== null;
 }
 
+// ---------------------------------------------------------------------------
+// In-memory identity-private-key store (Phase A1). Same lifecycle as the DEK:
+// held only for the authenticated session, cleared on logout, re-derived from
+// the wrapped form (under the account DEK) on unlock. Not consumed until Phase B.
+// ---------------------------------------------------------------------------
+
+let currentIdentityPrivate: CryptoKey | null = null;
+
+export function setIdentityPrivate(key: CryptoKey): void {
+  currentIdentityPrivate = key;
+}
+
+export function getIdentityPrivate(): CryptoKey | null {
+  return currentIdentityPrivate;
+}
+
+export function clearIdentityPrivate(): void {
+  currentIdentityPrivate = null;
+}
+
+export function hasIdentityPrivate(): boolean {
+  return currentIdentityPrivate !== null;
+}
+
 // ---------------------------------------------------------------------------
 // Backward compat: the old deriveAuthAndEncKeys (Phase 1 direct-from-password
 // enc key). Kept for tests; new code uses setupEncryption/unlockWithPassword.