Add the encrypted local cache and the sync client

Three new client projects, and the wire-contract fix they needed.

DodoSSH.Client.Domain holds the decrypted item model and the three-way
merge, with no I/O at all — so the suite that decides whether a
credential can be lost runs in milliseconds with nothing to mock.
Scalars defer to the server on a genuine clash so every replica resolves
the same triple identically and two clients cannot ping-pong; directives
merge per name so two people each adding one both keep theirs; the jump
chain merges as a whole value because its order is the route. Whatever
loses is returned rather than dropped.

DodoSSH.Client.Storage is EF Core on SQLite, no SQLCipher: the rows are
already ciphertext, so an encrypted file would protect protected bytes
at the cost of a native dependency. It keeps the server's state and the
outbox in separate tables, which is what preserves the common ancestor a
merge needs. One pending operation per item, enforced by a unique index.

DodoSSH.Client.Sync is the pull/apply/push loop. Pulling never decrypts
— a change with no local work pending is plumbed as ciphertext — so a
first sync of thousands of items does not run twice as many AEAD
operations for nothing.

Contracts: EncryptedPayload gains WrappedDataKey and DataKeyId. The
specification has required a per-item data key since crypto.md §3, the
columns have existed since the first migration and DshAad.ItemPayload
binds the id, but this record had nowhere to put either — so a
spec-compliant item could not be transmitted at all. Found by writing
the client that has to produce one. Also closes a hole in
AadResourceType, which had no value for the HostTag and HostCredential
that SyncEntityType has always listed.

Four bugs the tests found, not review:

- SQLite refuses to order or compare its own DateTimeOffset mapping, and
  throws at execution rather than model build. Collecting tombstones and
  listing conflicts are both that shape, so this was a crash waiting for
  the first user with a deleted host. Timestamps are integers now, by
  convention so a later field cannot be the one left unconverted.
- SQLitePCLRaw 2.1.11, which EF resolves, is covered by
  GHSA-2m69-gcr7-jv3q. Pinned forward as a family.
- Resurrecting content from a remote deletion cleared the original
  before queueing the copy. Two transactions, so a crash between them
  lost the work; reversed, and the rescued id is derived from the
  tombstone so a replay coalesces instead of duplicating.
- Several equality assertions went through Shouldly's ShouldBe, which
  compares IEnumerable element-wise and so tested nothing about the
  Equals these types exist to provide. Corrected; the falsification that
  caught it went from 2 failures to 6.

The push response's cursor is deliberately ignored. It sits after this
client's own writes, so adopting it skips anything another client
committed at a lower sequence in the window between a pull and a push —
permanently. Re-reading one's own writes is idempotent and costs a page.
The Contracts doc that invited the shortcut now says so.

593 tests, up from 448. The delete-versus-edit rules, the ancestor
retention, the fresh operation id on coalesce and the cursor safeguard
were each verified by breaking them and watching the right test fail.

src/DodoSSH.Crypto/CryptoSpec.cs

@@ -147,6 +147,17 @@ public static class CryptoSpec
 
         /// <summary>A known SSH host key.</summary>
         KnownHostKey = 11,
+
+        // 12 and 13 close a hole rather than adding a feature. Contracts.SyncEntityType has carried
+        // HostTag and HostCredential since it was frozen, so those items are syncable — but with no
+        // resource type here, their payloads had nothing to bind an AAD to. Added 2026-07-29, while
+        // the enum is still append-only and no such item has been stored.
+
+        /// <summary>A host-to-tag association.</summary>
+        HostTag = 12,
+
+        /// <summary>A host-to-credential association.</summary>
+        HostCredential = 13,
     }
 
     /// <summary>HKDF info labels. Domain-separated so one subkey cannot stand in for another.</summary>

src/DodoSSH.Crypto/DshAad.cs

@@ -124,16 +124,30 @@ public static class DshAad
             itemVersion);
 
     /// <summary>
-    /// Binds a record in the client's own on-disk cache.
+    /// Binds a record in the client's own on-disk cache to the row that holds it.
     /// </summary>
     /// <remarks>
+    /// <para>
     /// Separate from every server-side purpose so a cache record can never be accepted as vault
-    /// content, nor the reverse. The cache is local, so the adversary here is another process on
-    /// the same machine rather than the server.
+    /// content, nor the reverse. The threat model differs too: the cache is local, so the adversary
+    /// is a process or a backup with access to the file rather than the server.
+    /// </para>
+    /// <para>
+    /// <b>Changed 2026-07-29</b> from taking the user id to taking the record's identity. The user
+    /// was already bound by the key — <c>LocalCacheKey</c> is derived from that user's master key, so
+    /// another user's record cannot decrypt at all — which left the AAD binding nothing, and a cache
+    /// record could be moved to a different row of the same user's cache. For plaintext columns like
+    /// a relay address that is not academic: swapping two rows would point one host's connection at
+    /// another host's address. No cache has ever been written, so there is nothing to migrate.
+    /// </para>
     /// </remarks>
-    public static AadDescriptor LocalCache(Guid userId) =>
+    /// <param name="resourceType">What kind of item the record belongs to.</param>
+    /// <param name="recordId">The row it belongs to — an item id, or a conflict entry's own id.</param>
+    public static AadDescriptor LocalCache(
+        CryptoSpec.AadResourceType resourceType,
+        Guid recordId) =>
         AadDescriptor.Create(
             CryptoSpec.AadPurpose.LocalCache,
-            CryptoSpec.AadResourceType.User,
-            userId);
+            resourceType,
+            recordId);
 }