Add the encrypted local cache and the sync client

Three new client projects, and the wire-contract fix they needed.

DodoSSH.Client.Domain holds the decrypted item model and the three-way
merge, with no I/O at all — so the suite that decides whether a
credential can be lost runs in milliseconds with nothing to mock.
Scalars defer to the server on a genuine clash so every replica resolves
the same triple identically and two clients cannot ping-pong; directives
merge per name so two people each adding one both keep theirs; the jump
chain merges as a whole value because its order is the route. Whatever
loses is returned rather than dropped.

DodoSSH.Client.Storage is EF Core on SQLite, no SQLCipher: the rows are
already ciphertext, so an encrypted file would protect protected bytes
at the cost of a native dependency. It keeps the server's state and the
outbox in separate tables, which is what preserves the common ancestor a
merge needs. One pending operation per item, enforced by a unique index.

DodoSSH.Client.Sync is the pull/apply/push loop. Pulling never decrypts
— a change with no local work pending is plumbed as ciphertext — so a
first sync of thousands of items does not run twice as many AEAD
operations for nothing.

Contracts: EncryptedPayload gains WrappedDataKey and DataKeyId. The
specification has required a per-item data key since crypto.md §3, the
columns have existed since the first migration and DshAad.ItemPayload
binds the id, but this record had nowhere to put either — so a
spec-compliant item could not be transmitted at all. Found by writing
the client that has to produce one. Also closes a hole in
AadResourceType, which had no value for the HostTag and HostCredential
that SyncEntityType has always listed.

Four bugs the tests found, not review:

- SQLite refuses to order or compare its own DateTimeOffset mapping, and
  throws at execution rather than model build. Collecting tombstones and
  listing conflicts are both that shape, so this was a crash waiting for
  the first user with a deleted host. Timestamps are integers now, by
  convention so a later field cannot be the one left unconverted.
- SQLitePCLRaw 2.1.11, which EF resolves, is covered by
  GHSA-2m69-gcr7-jv3q. Pinned forward as a family.
- Resurrecting content from a remote deletion cleared the original
  before queueing the copy. Two transactions, so a crash between them
  lost the work; reversed, and the rescued id is derived from the
  tombstone so a replay coalesces instead of duplicating.
- Several equality assertions went through Shouldly's ShouldBe, which
  compares IEnumerable element-wise and so tested nothing about the
  Equals these types exist to provide. Corrected; the falsification that
  caught it went from 2 failures to 6.

The push response's cursor is deliberately ignored. It sits after this
client's own writes, so adopting it skips anything another client
committed at a lower sequence in the window between a pull and a push —
permanently. Re-reading one's own writes is idempotent and costs a page.
The Contracts doc that invited the shortcut now says so.

593 tests, up from 448. The delete-versus-edit rules, the ancestor
retention, the fresh operation id on coalesce and the cursor safeguard
were each verified by breaking them and watching the right test fail.

src/DodoSSH.Contracts/DodoSshJsonContext.cs

@@ -43,6 +43,9 @@ namespace DodoSSH.Contracts;
 [JsonSerializable(typeof(SyncPushRequest))]
 [JsonSerializable(typeof(SyncPushResponse))]
 [JsonSerializable(typeof(SyncChange))]
+// Registered in its own right, not only as a member of the sync DTOs: the client's local
+// cache seals this record under the LocalCacheKey and needs its type info directly.
+[JsonSerializable(typeof(SyncPlaintextFields))]
 [JsonSerializable(typeof(RelayTicketRequest))]
 [JsonSerializable(typeof(RelayTicketResponse))]
 [JsonSerializable(typeof(RelaySessionSummary))]

src/DodoSSH.Contracts/EncryptedPayload.cs

@@ -15,11 +15,32 @@ namespace DodoSSH.Contracts;
 /// rather than transmitted, and because they are what makes a lazy re-encrypt-on-write
 /// migration possible later.
 /// </para>
+/// <para>
+/// <b>Added 2026-07-29:</b> <see cref="WrappedDataKey"/> and <see cref="DataKeyId"/>. The
+/// specification has required a per-item data key since §3, the database has carried
+/// <c>data_key_wrap</c> and <c>content_key_id</c> since the first migration, and
+/// <c>DshAad.ItemPayload</c> binds the data key id — but this record had nowhere to put either,
+/// so a spec-compliant item could not actually be transmitted. Found by writing the client that
+/// has to produce one. Safe to add now and not later: no payload has ever been stored, and only
+/// clients can re-encrypt.
+/// </para>
 /// </remarks>
 /// <param name="Envelope">The complete DSH1 envelope, base64 on the wire.</param>
+/// <param name="WrappedDataKey">
+/// The item's data key, wrapped under the vault key. Also a DSH1 envelope, and also opaque. It
+/// travels with the payload because a data key belongs to one item <em>version</em>: rotating a
+/// vault key re-wraps 32 bytes per item and never rewrites a content blob.
+/// </param>
+/// <param name="DataKeyId">
+/// Identifies the data key, stored as <c>content_key_id</c>. Part of the payload's AAD, so a
+/// server cannot pair one item's envelope with another's key wrap. Reserved as the seam for
+/// per-item grants in M5.
+/// </param>
 /// <param name="KeyGeneration">Vault key generation this payload was encrypted under.</param>
 /// <param name="AadVersion">Version of the AAD derivation rule used.</param>
 public sealed record EncryptedPayload(
     byte[] Envelope,
+    byte[] WrappedDataKey,
+    Guid DataKeyId,
     uint KeyGeneration,
     byte AadVersion);

src/DodoSSH.Contracts/PublicAPI.Unshipped.txt

@@ -36,13 +36,17 @@ DodoSSH.Contracts.EncryptedPayload
 DodoSSH.Contracts.EncryptedPayload.<Clone>$() -> DodoSSH.Contracts.EncryptedPayload!
 DodoSSH.Contracts.EncryptedPayload.AadVersion.get -> byte
 DodoSSH.Contracts.EncryptedPayload.AadVersion.init -> void
-DodoSSH.Contracts.EncryptedPayload.Deconstruct(out byte[]! Envelope, out uint KeyGeneration, out byte AadVersion) -> void
-DodoSSH.Contracts.EncryptedPayload.EncryptedPayload(byte[]! Envelope, uint KeyGeneration, byte AadVersion) -> void
+DodoSSH.Contracts.EncryptedPayload.DataKeyId.get -> System.Guid
+DodoSSH.Contracts.EncryptedPayload.DataKeyId.init -> void
+DodoSSH.Contracts.EncryptedPayload.Deconstruct(out byte[]! Envelope, out byte[]! WrappedDataKey, out System.Guid DataKeyId, out uint KeyGeneration, out byte AadVersion) -> void
+DodoSSH.Contracts.EncryptedPayload.EncryptedPayload(byte[]! Envelope, byte[]! WrappedDataKey, System.Guid DataKeyId, uint KeyGeneration, byte AadVersion) -> void
 DodoSSH.Contracts.EncryptedPayload.Envelope.get -> byte[]!
 DodoSSH.Contracts.EncryptedPayload.Envelope.init -> void
 DodoSSH.Contracts.EncryptedPayload.Equals(DodoSSH.Contracts.EncryptedPayload? other) -> bool
 DodoSSH.Contracts.EncryptedPayload.KeyGeneration.get -> uint
 DodoSSH.Contracts.EncryptedPayload.KeyGeneration.init -> void
+DodoSSH.Contracts.EncryptedPayload.WrappedDataKey.get -> byte[]!
+DodoSSH.Contracts.EncryptedPayload.WrappedDataKey.init -> void
 DodoSSH.Contracts.EnrollmentRequest
 DodoSSH.Contracts.EnrollmentRequest.<Clone>$() -> DodoSSH.Contracts.EnrollmentRequest!
 DodoSSH.Contracts.EnrollmentRequest.Deconstruct(out DodoSSH.Contracts.KeyStatement! Statement, out byte[]! StatementSignature, out string! IdentityProviderToken, out byte[]! WrappedPrivateKey, out DodoSSH.Contracts.KdfParameters! KdfParameters, out byte[]? DevicePublicKey, out byte[]? DeviceWrappedPrivateKey, out byte[]? RecoveryWrappedPrivateKey, out DodoSSH.Contracts.KdfParameters? RecoveryKdfParameters, out DodoSSH.Contracts.PersonalVaultRequest! PersonalVault) -> void

src/DodoSSH.Contracts/Sync.cs

@@ -91,8 +91,16 @@ public sealed record SyncPushResult(
 /// <summary>Per-operation outcomes for a push.</summary>
 /// <param name="Results">One entry per submitted operation, in request order.</param>
 /// <param name="Cursor">
-/// A cursor positioned after every change this push produced, so the client can continue
-/// pulling without re-reading its own writes.
+/// A cursor positioned after every change this push produced.
+/// <para>
+/// <b>Adopting this is only safe if the client had already pulled to the log head.</b> The cursor is
+/// a sequence position, so if another client committed at sequence 10 while this push took 11,
+/// jumping to 11 skips 10 permanently. The per-vault advisory lock guarantees that sequence order
+/// matches commit order; it cannot tell this client about a write it never read. A client that
+/// keeps its own cursor and re-reads its own writes — which is idempotent, since applying a change
+/// is a blind overwrite of a local mirror — is strictly safer, and that is what
+/// <c>DodoSSH.Client.Sync</c> does.
+/// </para>
 /// </param>
 public sealed record SyncPushResponse(
     IReadOnlyList<SyncPushResult> Results,