Add the encrypted local cache and the sync client

Three new client projects, and the wire-contract fix they needed.

DodoSSH.Client.Domain holds the decrypted item model and the three-way
merge, with no I/O at all — so the suite that decides whether a
credential can be lost runs in milliseconds with nothing to mock.
Scalars defer to the server on a genuine clash so every replica resolves
the same triple identically and two clients cannot ping-pong; directives
merge per name so two people each adding one both keep theirs; the jump
chain merges as a whole value because its order is the route. Whatever
loses is returned rather than dropped.

DodoSSH.Client.Storage is EF Core on SQLite, no SQLCipher: the rows are
already ciphertext, so an encrypted file would protect protected bytes
at the cost of a native dependency. It keeps the server's state and the
outbox in separate tables, which is what preserves the common ancestor a
merge needs. One pending operation per item, enforced by a unique index.

DodoSSH.Client.Sync is the pull/apply/push loop. Pulling never decrypts
— a change with no local work pending is plumbed as ciphertext — so a
first sync of thousands of items does not run twice as many AEAD
operations for nothing.

Contracts: EncryptedPayload gains WrappedDataKey and DataKeyId. The
specification has required a per-item data key since crypto.md §3, the
columns have existed since the first migration and DshAad.ItemPayload
binds the id, but this record had nowhere to put either — so a
spec-compliant item could not be transmitted at all. Found by writing
the client that has to produce one. Also closes a hole in
AadResourceType, which had no value for the HostTag and HostCredential
that SyncEntityType has always listed.

Four bugs the tests found, not review:

- SQLite refuses to order or compare its own DateTimeOffset mapping, and
  throws at execution rather than model build. Collecting tombstones and
  listing conflicts are both that shape, so this was a crash waiting for
  the first user with a deleted host. Timestamps are integers now, by
  convention so a later field cannot be the one left unconverted.
- SQLitePCLRaw 2.1.11, which EF resolves, is covered by
  GHSA-2m69-gcr7-jv3q. Pinned forward as a family.
- Resurrecting content from a remote deletion cleared the original
  before queueing the copy. Two transactions, so a crash between them
  lost the work; reversed, and the rescued id is derived from the
  tombstone so a replay coalesces instead of duplicating.
- Several equality assertions went through Shouldly's ShouldBe, which
  compares IEnumerable element-wise and so tested nothing about the
  Equals these types exist to provide. Corrected; the falsification that
  caught it went from 2 failures to 6.

The push response's cursor is deliberately ignored. It sits after this
client's own writes, so adopting it skips anything another client
committed at a lower sequence in the window between a pull and a push —
permanently. Re-reading one's own writes is idempotent and costs a page.
The Contracts doc that invited the shortcut now says so.

593 tests, up from 448. The delete-versus-edit rules, the ancestor
retention, the fresh operation id on coalesce and the cursor safeguard
were each verified by breaking them and watching the right test fail.

src/DodoSSH.Client.Sync/VaultKeyring.cs

@@ -0,0 +1,149 @@
+using System.Diagnostics.CodeAnalysis;
+using System.Security.Cryptography;
+using DodoSSH.Client.Storage;
+using DodoSSH.Crypto;
+
+namespace DodoSSH.Client.Sync;
+
+/// <summary>
+/// The vault keys held for the duration of an unlocked session.
+/// </summary>
+/// <remarks>
+/// <para>
+/// One place that holds plaintext vault keys, so there is one place that clears them. Every store and
+/// every cipher call borrows a key from here rather than keeping a copy, which is what makes
+/// "the keys exist only while unlocked" a property of the code and not of everyone's discipline.
+/// </para>
+/// <para>
+/// A grant that will not open is not an error: it means the vault has been rekeyed and this client's
+/// grant has not been re-wrapped yet, or the grant was fabricated. Both leave the vault temporarily
+/// unreadable and both are reported rather than thrown, so one bad grant does not take the other vaults
+/// down with it.
+/// </para>
+/// </remarks>
+public sealed class VaultKeyring : IDisposable
+{
+    private readonly Dictionary<Guid, byte[]> keys = [];
+    private readonly Dictionary<Guid, uint> generations = [];
+    private bool disposed;
+
+    private VaultKeyring()
+    {
+    }
+
+    /// <summary>Vaults whose grant could not be opened, and which are therefore unreadable.</summary>
+    public IReadOnlyList<Guid> Unopened { get; private set; } = [];
+
+    /// <summary>
+    /// Opens every grant the bundle can.
+    /// </summary>
+    /// <param name="bundle">The unlocked identity keys.</param>
+    /// <param name="vaults">The cached vault list, each with its wrapped key.</param>
+    public static VaultKeyring Open(UserSecretBundle bundle, IReadOnlyList<StoredVault> vaults)
+    {
+        ArgumentNullException.ThrowIfNull(bundle);
+        ArgumentNullException.ThrowIfNull(vaults);
+
+        var keyring = new VaultKeyring();
+        var unopened = new List<Guid>();
+
+        try
+        {
+            foreach (var vault in vaults)
+            {
+                if (vault.WrappedVaultKey is null)
+                {
+                    // The server said so itself: a grant awaiting re-wrap after a rekey.
+                    unopened.Add(vault.VaultId);
+                    continue;
+                }
+
+                var key = VaultKeys.TryUnwrap(
+                    bundle.EncryptionKey,
+                    vault.WrappedVaultKey,
+                    vault.VaultId,
+                    vault.KeyGeneration);
+
+                if (key is null)
+                {
+                    unopened.Add(vault.VaultId);
+                    continue;
+                }
+
+                keyring.keys[vault.VaultId] = key;
+                keyring.generations[vault.VaultId] = vault.KeyGeneration;
+            }
+
+            keyring.Unopened = unopened;
+            return keyring;
+        }
+        catch
+        {
+            keyring.Dispose();
+            throw;
+        }
+    }
+
+    /// <summary>
+    /// Borrows a vault's key.
+    /// </summary>
+    /// <remarks>
+    /// The returned memory is the keyring's own buffer, not a copy, and is zeroed when the keyring is
+    /// disposed. Callers must not retain it past the operation they borrowed it for.
+    /// </remarks>
+    public bool TryGet(Guid vaultId, out ReadOnlyMemory<byte> vaultKey, out uint keyGeneration)
+    {
+        ObjectDisposedException.ThrowIf(disposed, this);
+
+        if (keys.TryGetValue(vaultId, out var key))
+        {
+            vaultKey = key;
+            keyGeneration = generations[vaultId];
+            return true;
+        }
+
+        vaultKey = default;
+        keyGeneration = 0;
+        return false;
+    }
+
+    /// <summary>Whether this vault can be read at all.</summary>
+    public bool CanRead(Guid vaultId) => !disposed && keys.ContainsKey(vaultId);
+
+    /// <inheritdoc />
+    public void Dispose()
+    {
+        if (disposed)
+        {
+            return;
+        }
+
+        disposed = true;
+
+        foreach (var key in keys.Values)
+        {
+            CryptographicOperations.ZeroMemory(key);
+        }
+
+        keys.Clear();
+        generations.Clear();
+    }
+}
+
+/// <summary>Thrown when an operation needs a vault key the keyring does not hold.</summary>
+/// <remarks>
+/// An exception rather than a silent no-op, because every caller that reaches this point has already
+/// been given the chance to check <see cref="VaultKeyring.CanRead"/>. Continuing without the key would
+/// mean writing an item nobody can open.
+/// </remarks>
+[SuppressMessage(
+    "Design",
+    "CA1032:Implement standard exception constructors",
+    Justification = "The vault id is required context; a message-only constructor would lose it.")]
+public sealed class VaultUnreadableException(Guid vaultId)
+    : InvalidOperationException(
+        $"Vault {vaultId} has no usable key. Its grant is missing or awaiting re-wrap after a rekey.")
+{
+    /// <summary>The vault that cannot be read.</summary>
+    public Guid VaultId { get; } = vaultId;
+}