feat(auth): add per-account X25519 identity keypair (#3)

Phase A1 of the multi-person sharing ADR
(docs/adr/multi-person-sharing.md). Each account now gets an X25519
keypair at registration: the public half stored plaintext, the private
half wrapped under the account DEK and stored as opaque ciphertext. The
keypair is generated client-side; the backend adds no crypto deps and
stores everything verbatim, preserving the zero-knowledge contract.

This change only introduces the keypair and threads it through the auth
flows — it is not consumed yet. It unblocks Phase B (profile sharing)
without touching the data model or the ~11 frontend encrypt call sites,
which is Phase A2 (per-profile DEKs).

Backend:
- User model: identity_public_key, identity_private_key_wrapped{,_iv}
  (all Option<String>, backward compatible).
- RegisterRequest/AuthResponse carry the 3 fields; register + login
  echo them. No changes to change_password/recover (DEK value is
  unchanged across both, so the wrapped private key is too).
- 2 new integration tests: round-trip through register/login, and
  optional-fields backward compat.

Frontend:
- crypto/keys.ts: generateIdentityKeyPair, wrapIdentityPrivateKey,
  unwrapIdentityPrivateKey + in-memory identity store mirroring the DEK.
- types/api.ts: AuthTokens + RegisterRequest extended (removes an
  existing `as any` cast).
- useStore register/login/logout + UnlockPage unwrap the private key
  alongside the DEK.
- 3 new crypto tests (X25519 lifecycle, wrong-DEK rejection, distinct
  shared secrets); skip gracefully where the runtime lacks X25519.

Backend: cargo test + clippy green. Frontend: npm test + tsc green.

Also gitignore .zcode/ (local tooling artifact).

web/normogen-web/src/store/useStore.ts

@@ -6,8 +6,13 @@ import {
   unlockWithPassword,
   unlockWithRecovery,
   rewrapDek,
+  generateIdentityKeyPair,
+  wrapIdentityPrivateKey,
+  unwrapIdentityPrivateKey,
   setEncKey,
   clearEncKey,
+  clearIdentityPrivate,
+  setIdentityPrivate,
   getEncKey,
   encryptJson,
   decryptJson,
@@ -38,6 +43,12 @@ interface AuthState {
   // on page reload without a full re-login.
   wrapped_dek: string | null;
   wrapped_dek_iv: string | null;
+  // Account X25519 identity keypair (Phase A1). The public key is plaintext;
+  // the private key is the DEK-wrapped ciphertext blob. Persisted for the same
+  // reason as the wrapped DEK — the unlock screen unwraps it into memory.
+  identity_public_key: string | null;
+  identity_private_key_wrapped: string | null;
+  identity_private_key_wrapped_iv: string | null;
 
   // Actions
   login: (email: string, password: string) => Promise<void>;
@@ -128,6 +139,9 @@ export const useAuthStore = create<AuthState>()(
         error: null,
         wrapped_dek: null,
         wrapped_dek_iv: null,
+        identity_public_key: null,
+        identity_private_key_wrapped: null,
+        identity_private_key_wrapped_iv: null,
 
         login: async (email: string, password: string) => {
           set({ isLoading: true, error: null });
@@ -144,6 +158,26 @@ export const useAuthStore = create<AuthState>()(
                   iv: response.wrapped_dek_iv,
                 });
                 setEncKey(dek);
+                // Once the DEK is available, also unwrap the X25519 identity
+                // private key (Phase A1) into in-memory storage.
+                if (
+                  response.identity_private_key_wrapped &&
+                  response.identity_private_key_wrapped_iv
+                ) {
+                  try {
+                    const identityPrivate = await unwrapIdentityPrivateKey(
+                      {
+                        data: response.identity_private_key_wrapped,
+                        iv: response.identity_private_key_wrapped_iv,
+                      },
+                      dek,
+                    );
+                    setIdentityPrivate(identityPrivate);
+                  } catch {
+                    // Wrapped private key present but failed to unwrap —
+                    // non-fatal; Phase B features will surface a re-setup need.
+                  }
+                }
               } catch {
                 // Fallback to the PBKDF2-derived key (Phase 1 compat).
               }
@@ -160,6 +194,9 @@ export const useAuthStore = create<AuthState>()(
               isLoading: false,
               wrapped_dek: response.wrapped_dek ?? null,
               wrapped_dek_iv: response.wrapped_dek_iv ?? null,
+              identity_public_key: response.identity_public_key ?? null,
+              identity_private_key_wrapped: response.identity_private_key_wrapped ?? null,
+              identity_private_key_wrapped_iv: response.identity_private_key_wrapped_iv ?? null,
             });
           } catch (error: any) {
             clearEncKey();
@@ -181,6 +218,13 @@ export const useAuthStore = create<AuthState>()(
             const setup = await setupEncryption(password, recoveryPhrase);
             setEncKey(setup.dek);
 
+            // Phase A1: generate the account X25519 identity keypair and wrap
+            // the private half under the account DEK. The public key is sent
+            // plaintext; the wrapped private key is opaque ciphertext.
+            const { publicKey, privateKey } = await generateIdentityKeyPair();
+            const wrappedPrivate = await wrapIdentityPrivateKey(privateKey, setup.dek);
+            setIdentityPrivate(privateKey);
+
             const response = await apiService.register({
               username,
               email,
@@ -190,7 +234,10 @@ export const useAuthStore = create<AuthState>()(
               recovery_wrapped_dek: setup.recoveryWrappedDek?.data,
               recovery_wrapped_dek_iv: setup.recoveryWrappedDek?.iv,
               recovery_phrase: setup.recoveryKekHash,
-            } as any);
+              identity_public_key: publicKey,
+              identity_private_key_wrapped: wrappedPrivate.data,
+              identity_private_key_wrapped_iv: wrappedPrivate.iv,
+            });
             set({
               user: {
                 user_id: response.user_id,
@@ -203,6 +250,9 @@ export const useAuthStore = create<AuthState>()(
               isLoading: false,
               wrapped_dek: setup.passwordWrappedDek.data,
               wrapped_dek_iv: setup.passwordWrappedDek.iv,
+              identity_public_key: publicKey,
+              identity_private_key_wrapped: wrappedPrivate.data,
+              identity_private_key_wrapped_iv: wrappedPrivate.iv,
             });
           } catch (error: any) {
             set({
@@ -254,6 +304,7 @@ export const useAuthStore = create<AuthState>()(
 
         logout: async () => {
           clearEncKey();
+          clearIdentityPrivate();
           await apiService.logout();
           set({
             user: null,
@@ -262,6 +313,9 @@ export const useAuthStore = create<AuthState>()(
             error: null,
             wrapped_dek: null,
             wrapped_dek_iv: null,
+            identity_public_key: null,
+            identity_private_key_wrapped: null,
+            identity_private_key_wrapped_iv: null,
           });
         },
 
@@ -296,6 +350,9 @@ export const useAuthStore = create<AuthState>()(
           isAuthenticated: state.isAuthenticated,
           wrapped_dek: state.wrapped_dek,
           wrapped_dek_iv: state.wrapped_dek_iv,
+          identity_public_key: state.identity_public_key,
+          identity_private_key_wrapped: state.identity_private_key_wrapped,
+          identity_private_key_wrapped_iv: state.identity_private_key_wrapped_iv,
         }),
       }
     )