Add the encrypted local cache and the sync client

Three new client projects, and the wire-contract fix they needed.

DodoSSH.Client.Domain holds the decrypted item model and the three-way
merge, with no I/O at all — so the suite that decides whether a
credential can be lost runs in milliseconds with nothing to mock.
Scalars defer to the server on a genuine clash so every replica resolves
the same triple identically and two clients cannot ping-pong; directives
merge per name so two people each adding one both keep theirs; the jump
chain merges as a whole value because its order is the route. Whatever
loses is returned rather than dropped.

DodoSSH.Client.Storage is EF Core on SQLite, no SQLCipher: the rows are
already ciphertext, so an encrypted file would protect protected bytes
at the cost of a native dependency. It keeps the server's state and the
outbox in separate tables, which is what preserves the common ancestor a
merge needs. One pending operation per item, enforced by a unique index.

DodoSSH.Client.Sync is the pull/apply/push loop. Pulling never decrypts
— a change with no local work pending is plumbed as ciphertext — so a
first sync of thousands of items does not run twice as many AEAD
operations for nothing.

Contracts: EncryptedPayload gains WrappedDataKey and DataKeyId. The
specification has required a per-item data key since crypto.md §3, the
columns have existed since the first migration and DshAad.ItemPayload
binds the id, but this record had nowhere to put either — so a
spec-compliant item could not be transmitted at all. Found by writing
the client that has to produce one. Also closes a hole in
AadResourceType, which had no value for the HostTag and HostCredential
that SyncEntityType has always listed.

Four bugs the tests found, not review:

- SQLite refuses to order or compare its own DateTimeOffset mapping, and
  throws at execution rather than model build. Collecting tombstones and
  listing conflicts are both that shape, so this was a crash waiting for
  the first user with a deleted host. Timestamps are integers now, by
  convention so a later field cannot be the one left unconverted.
- SQLitePCLRaw 2.1.11, which EF resolves, is covered by
  GHSA-2m69-gcr7-jv3q. Pinned forward as a family.
- Resurrecting content from a remote deletion cleared the original
  before queueing the copy. Two transactions, so a crash between them
  lost the work; reversed, and the rescued id is derived from the
  tombstone so a replay coalesces instead of duplicating.
- Several equality assertions went through Shouldly's ShouldBe, which
  compares IEnumerable element-wise and so tested nothing about the
  Equals these types exist to provide. Corrected; the falsification that
  caught it went from 2 failures to 6.

The push response's cursor is deliberately ignored. It sits after this
client's own writes, so adopting it skips anything another client
committed at a lower sequence in the window between a pull and a push —
permanently. Re-reading one's own writes is idempotent and costs a page.
The Contracts doc that invited the shortcut now says so.

593 tests, up from 448. The delete-versus-edit rules, the ancestor
retention, the fresh operation id on coalesce and the cursor safeguard
were each verified by breaking them and watching the right test fail.

src/DodoSSH.Client.Storage/VaultStore.cs

@@ -0,0 +1,113 @@
+using Microsoft.EntityFrameworkCore;
+
+namespace DodoSSH.Client.Storage;
+
+/// <summary>
+/// The vaults this user can reach, and the grants that open them.
+/// </summary>
+/// <remarks>
+/// Cached for the same reason as the unlock material: without the wrapped vault key on disk, an offline
+/// launch could unlock the identity bundle and still not decrypt a single item. Every value here is
+/// either public metadata or ciphertext.
+/// </remarks>
+public sealed class VaultStore(IDbContextFactory<ClientCacheContext> contexts, TimeProvider clock)
+{
+    /// <summary>Reads every known vault.</summary>
+    public async Task<IReadOnlyList<StoredVault>> ListAsync(CancellationToken cancellationToken)
+    {
+        var context = contexts.CreateDbContext();
+        await using var scope = context.ConfigureAwait(false);
+
+        var rows = await context.Set<CachedVaultRow>()
+            .AsNoTracking()
+            .OrderByDescending(row => row.IsPersonal)
+            .ThenBy(row => row.Name)
+            .ToListAsync(cancellationToken)
+            .ConfigureAwait(false);
+
+        return [.. rows.Select(ToStored)];
+    }
+
+    /// <summary>Reads one vault.</summary>
+    public async Task<StoredVault?> FindAsync(Guid vaultId, CancellationToken cancellationToken)
+    {
+        var context = contexts.CreateDbContext();
+        await using var scope = context.ConfigureAwait(false);
+
+        var row = await context.Set<CachedVaultRow>()
+            .AsNoTracking()
+            .SingleOrDefaultAsync(r => r.VaultId == vaultId, cancellationToken)
+            .ConfigureAwait(false);
+
+        return row is null ? null : ToStored(row);
+    }
+
+    /// <summary>
+    /// Replaces the cached vault list with what the server reported.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Vaults absent from the list are removed, because losing access to a vault is exactly what that
+    /// absence means and a stale row would offer the user a vault they can no longer sync.
+    /// </para>
+    /// <para>
+    /// Their <em>items</em> are a separate matter and are not touched here. Removing a member does not
+    /// retroactively erase what they already hold — that is not achievable, which is why offboarding
+    /// means rotating the SSH credential rather than revoking a grant. Deleting the local rows here
+    /// would only make the client pretend otherwise.
+    /// </para>
+    /// </remarks>
+    public async Task ReplaceAllAsync(
+        IReadOnlyList<StoredVault> vaults,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(vaults);
+
+        var context = contexts.CreateDbContext();
+        await using var scope = context.ConfigureAwait(false);
+
+        var existing = await context.Set<CachedVaultRow>()
+            .ToDictionaryAsync(row => row.VaultId, cancellationToken)
+            .ConfigureAwait(false);
+
+        var now = clock.GetUtcNow();
+
+        foreach (var vault in vaults)
+        {
+            if (!existing.Remove(vault.VaultId, out var row))
+            {
+                row = new CachedVaultRow { VaultId = vault.VaultId };
+                context.Add(row);
+            }
+
+            Apply(row, vault, now);
+        }
+
+        context.RemoveRange(existing.Values);
+
+        await context.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
+    }
+
+    private static void Apply(CachedVaultRow row, StoredVault vault, DateTimeOffset now)
+    {
+        row.Name = vault.Name;
+        row.IsPersonal = vault.IsPersonal;
+        row.TeamId = vault.TeamId;
+        row.KeyGeneration = vault.KeyGeneration;
+        row.Permissions = vault.Permissions;
+        row.WrappedVaultKey = vault.WrappedVaultKey;
+        row.RekeyRequired = vault.RekeyRequired;
+        row.UpdatedAtUtc = now;
+    }
+
+    private static StoredVault ToStored(CachedVaultRow row) =>
+        new(
+            row.VaultId,
+            row.Name,
+            row.IsPersonal,
+            row.TeamId,
+            row.KeyGeneration,
+            row.Permissions,
+            row.WrappedVaultKey,
+            row.RekeyRequired);
+}