Add the encrypted local cache and the sync client

Three new client projects, and the wire-contract fix they needed.

DodoSSH.Client.Domain holds the decrypted item model and the three-way
merge, with no I/O at all — so the suite that decides whether a
credential can be lost runs in milliseconds with nothing to mock.
Scalars defer to the server on a genuine clash so every replica resolves
the same triple identically and two clients cannot ping-pong; directives
merge per name so two people each adding one both keep theirs; the jump
chain merges as a whole value because its order is the route. Whatever
loses is returned rather than dropped.

DodoSSH.Client.Storage is EF Core on SQLite, no SQLCipher: the rows are
already ciphertext, so an encrypted file would protect protected bytes
at the cost of a native dependency. It keeps the server's state and the
outbox in separate tables, which is what preserves the common ancestor a
merge needs. One pending operation per item, enforced by a unique index.

DodoSSH.Client.Sync is the pull/apply/push loop. Pulling never decrypts
— a change with no local work pending is plumbed as ciphertext — so a
first sync of thousands of items does not run twice as many AEAD
operations for nothing.

Contracts: EncryptedPayload gains WrappedDataKey and DataKeyId. The
specification has required a per-item data key since crypto.md §3, the
columns have existed since the first migration and DshAad.ItemPayload
binds the id, but this record had nowhere to put either — so a
spec-compliant item could not be transmitted at all. Found by writing
the client that has to produce one. Also closes a hole in
AadResourceType, which had no value for the HostTag and HostCredential
that SyncEntityType has always listed.

Four bugs the tests found, not review:

- SQLite refuses to order or compare its own DateTimeOffset mapping, and
  throws at execution rather than model build. Collecting tombstones and
  listing conflicts are both that shape, so this was a crash waiting for
  the first user with a deleted host. Timestamps are integers now, by
  convention so a later field cannot be the one left unconverted.
- SQLitePCLRaw 2.1.11, which EF resolves, is covered by
  GHSA-2m69-gcr7-jv3q. Pinned forward as a family.
- Resurrecting content from a remote deletion cleared the original
  before queueing the copy. Two transactions, so a crash between them
  lost the work; reversed, and the rescued id is derived from the
  tombstone so a replay coalesces instead of duplicating.
- Several equality assertions went through Shouldly's ShouldBe, which
  compares IEnumerable element-wise and so tested nothing about the
  Equals these types exist to provide. Corrected; the falsification that
  caught it went from 2 failures to 6.

The push response's cursor is deliberately ignored. It sits after this
client's own writes, so adopting it skips anything another client
committed at a lower sequence in the window between a pull and a push —
permanently. Re-reading one's own writes is idempotent and costs a page.
The Contracts doc that invited the shortcut now says so.

593 tests, up from 448. The delete-versus-edit rules, the ancestor
retention, the fresh operation id on coalesce and the cursor safeguard
were each verified by breaking them and watching the right test fail.

docs/crypto.md

@@ -230,12 +230,26 @@ value can forge a field boundary. UUIDs must be serialised in RFC 4122 order —
 | 3 | `ItemDataKey` | a data key wrapped under a vault key |
 | 4 | `ItemPayload` | item plaintext under its data key |
 | 5 | `ItemMetadata` | encrypted host metadata under its data key |
-| 6 | `LocalCache` | a client's on-disk cache record |
+| 6 | `LocalCache` | a client's on-disk cache record, bound to its own row |
+
+> **Changed 2026-07-29:** `LocalCache` binds `resourceType` and the record's own id rather
+> than the user id. The user is already bound by the key — `LocalCacheKey` derives from that
+> user's MK — so binding it again in the AAD constrained nothing, and left cache records
+> interchangeable between rows of the same cache. For a plaintext column such as a
+> relay-enabled host's address, swapping two rows would aim one host's connection at
+> another's. No cache has been written, so nothing needs migrating.
 
 ### 4.3 `resourceType`
 
 `1` User, `2` Device, `3` Vault, `4` Host, `5` Credential, `6` SshKey, `7` HostGroup,
-`8` Tag, `9` Snippet, `10` PortForward, `11` KnownHostKey.
+`8` Tag, `9` Snippet, `10` PortForward, `11` KnownHostKey, `12` HostTag,
+`13` HostCredential.
+
+> **Added 2026-07-29:** `12` and `13`. `Contracts.SyncEntityType` has listed `HostTag` and
+> `HostCredential` as syncable since the contract was frozen, but this table had no value for
+> either — so an association row's payload had no resource type to bind to, and the first
+> implementation to need one would have had to invent a value or reuse a neighbour's. Append
+> only, and no such item has been stored.
 
 `0` means not applicable and is legal only where the table in §4.2 implies no resource.
 

docs/platform-flags.md

@@ -103,6 +103,29 @@ minimal desktop or inside a Flatpak sandbox — where the portal is the correct
 sign-in silently does nothing on Linux, this is the first thing to check. `IBrowserLauncher` exists
 so a platform-specific opener can be substituted without touching the flow.
 
+## Local cache
+
+**The cache file has no location yet.** `ClientCacheFactory.ForFile` takes a full path and the
+application does not yet choose one, because nothing wires the cache into the shell so far. When it
+does, the path must be per-OS — `%LOCALAPPDATA%` on Windows, `~/Library/Application Support` on macOS,
+`$XDG_DATA_HOME` or `~/.local/share` on Linux — and it must **not** land in a directory that syncs to
+a cloud drive. Two machines writing one SQLite file through a file-sync client corrupts it, and the
+whole point of the outbox is that each machine has its own. `Environment.SpecialFolder.LocalApplicationData`
+maps correctly on all three, but on Linux it ignores `XDG_DATA_HOME` and returns `~/.local/share`
+unconditionally. *Unverified off Windows.*
+
+**SQLite timestamps are stored as integers, deliberately.** EF's default `DateTimeOffset` mapping for
+SQLite is a text form it then refuses to order or compare, so any query that sorts or filters by time
+throws at execution rather than at model build. `UnixMillisecondsConverter` is applied as a convention
+so a timestamp added later cannot be the one left unconverted. This is provider behaviour, not
+platform behaviour, but it cost a debugging session and will again if the converter is removed.
+
+**No SQLCipher, on any platform.** The rows are already ciphertext from the server, so an encrypted
+database file would protect bytes that are protected already at the cost of a native dependency and a
+licence obligation — and `bundle_e_sqlcipher` was deprecated in SQLitePCLRaw 3.0. The consequence to
+be honest about: the cache offers no protection against another process running as the same user. See
+`LocalCacheProtector` for what it does and does not defend against.
+
 ## Build and CI
 
 **Integration tests need a Docker daemon** (Testcontainers). They run on `ubuntu-latest` in CI.