Add the encrypted local cache and the sync client

Three new client projects, and the wire-contract fix they needed.

DodoSSH.Client.Domain holds the decrypted item model and the three-way
merge, with no I/O at all — so the suite that decides whether a
credential can be lost runs in milliseconds with nothing to mock.
Scalars defer to the server on a genuine clash so every replica resolves
the same triple identically and two clients cannot ping-pong; directives
merge per name so two people each adding one both keep theirs; the jump
chain merges as a whole value because its order is the route. Whatever
loses is returned rather than dropped.

DodoSSH.Client.Storage is EF Core on SQLite, no SQLCipher: the rows are
already ciphertext, so an encrypted file would protect protected bytes
at the cost of a native dependency. It keeps the server's state and the
outbox in separate tables, which is what preserves the common ancestor a
merge needs. One pending operation per item, enforced by a unique index.

DodoSSH.Client.Sync is the pull/apply/push loop. Pulling never decrypts
— a change with no local work pending is plumbed as ciphertext — so a
first sync of thousands of items does not run twice as many AEAD
operations for nothing.

Contracts: EncryptedPayload gains WrappedDataKey and DataKeyId. The
specification has required a per-item data key since crypto.md §3, the
columns have existed since the first migration and DshAad.ItemPayload
binds the id, but this record had nowhere to put either — so a
spec-compliant item could not be transmitted at all. Found by writing
the client that has to produce one. Also closes a hole in
AadResourceType, which had no value for the HostTag and HostCredential
that SyncEntityType has always listed.

Four bugs the tests found, not review:

- SQLite refuses to order or compare its own DateTimeOffset mapping, and
  throws at execution rather than model build. Collecting tombstones and
  listing conflicts are both that shape, so this was a crash waiting for
  the first user with a deleted host. Timestamps are integers now, by
  convention so a later field cannot be the one left unconverted.
- SQLitePCLRaw 2.1.11, which EF resolves, is covered by
  GHSA-2m69-gcr7-jv3q. Pinned forward as a family.
- Resurrecting content from a remote deletion cleared the original
  before queueing the copy. Two transactions, so a crash between them
  lost the work; reversed, and the rescued id is derived from the
  tombstone so a replay coalesces instead of duplicating.
- Several equality assertions went through Shouldly's ShouldBe, which
  compares IEnumerable element-wise and so tested nothing about the
  Equals these types exist to provide. Corrected; the falsification that
  caught it went from 2 failures to 6.

The push response's cursor is deliberately ignored. It sits after this
client's own writes, so adopting it skips anything another client
committed at a lower sequence in the window between a pull and a push —
permanently. Re-reading one's own writes is idempotent and costs a page.
The Contracts doc that invited the shortcut now says so.

593 tests, up from 448. The delete-versus-edit rules, the ancestor
retention, the fresh operation id on coalesce and the cursor safeguard
were each verified by breaking them and watching the right test fail.

tests/DodoSSH.Client.Sync.Tests/SyncHarness.cs

@@ -0,0 +1,252 @@
+using DodoSSH.Client.Domain;
+using DodoSSH.Client.Storage;
+using DodoSSH.Crypto;
+
+namespace DodoSSH.Client.Sync.Tests;
+
+/// <summary>
+/// One machine: its own cache, its own outbox, its own view of the vault.
+/// </summary>
+/// <remarks>
+/// A separate SQLite database per device, because the whole subject of these tests is two caches
+/// diverging and being reconciled. Sharing one would make every conflict test vacuous.
+/// </remarks>
+internal sealed class SyncDevice : IDisposable
+{
+    private readonly ClientCacheFactory factory;
+    private readonly MasterKey master;
+    private readonly LocalCacheProtector protector;
+
+    private SyncDevice(
+        string name,
+        ClientCacheFactory factory,
+        MasterKey master,
+        LocalCacheProtector protector,
+        VaultKeyring keyring,
+        FakeVaultServer server,
+        SyncOptions options)
+    {
+        Name = name;
+        this.factory = factory;
+        this.master = master;
+        this.protector = protector;
+        Keyring = keyring;
+
+        Items = new ItemStore(factory, protector);
+        Outbox = new OutboxStore(factory, protector, TimeProvider.System);
+        SyncState = new SyncStateStore(factory);
+        Conflicts = new ConflictStore(factory, protector, TimeProvider.System);
+        Hosts = new HostRepository(Items, Outbox, keyring);
+
+        Engine = new SyncEngine(
+            server, Items, Outbox, SyncState, Conflicts, keyring, TimeProvider.System, options);
+    }
+
+    internal string Name { get; }
+
+    internal VaultKeyring Keyring { get; }
+
+    internal ItemStore Items { get; }
+
+    internal OutboxStore Outbox { get; }
+
+    internal SyncStateStore SyncState { get; }
+
+    internal ConflictStore Conflicts { get; }
+
+    internal HostRepository Hosts { get; }
+
+    internal SyncEngine Engine { get; }
+
+    internal static async Task<SyncDevice> CreateAsync(
+        string name,
+        UserSecretBundle bundle,
+        StoredVault vault,
+        FakeVaultServer server,
+        SyncOptions options)
+    {
+        var cache = ClientCacheFactory.ForMemory($"sync-{name}-{Guid.CreateVersion7():N}");
+
+        try
+        {
+            await cache.MigrateAsync(TestContext.Current.CancellationToken);
+
+            var derived = MasterKey.Derive(
+                $"passphrase-{name}", new byte[CryptoSpec.SaltSize], SyncHarness.CheapProfile);
+
+            // Opened through the real grant, so the keyring, the wrap and the AAD are all exercised.
+            var keyring = VaultKeyring.Open(bundle, [vault]);
+
+            return new SyncDevice(
+                name, cache, derived, LocalCacheProtector.From(derived), keyring, server, options);
+        }
+        catch
+        {
+            cache.Dispose();
+            throw;
+        }
+    }
+
+    internal Task<SyncReport> SyncAsync() =>
+        Engine.SyncAsync(SyncHarness.VaultId, TestContext.Current.CancellationToken);
+
+    internal Task<HostListing> ListAsync() =>
+        Hosts.ListAsync(SyncHarness.VaultId, TestContext.Current.CancellationToken);
+
+    internal async Task<IReadOnlyList<HostSecret>> HostsSortedAsync()
+    {
+        var listing = await ListAsync();
+
+        return [.. listing.Hosts.Select(h => h.Host).OrderBy(h => h.Label, StringComparer.Ordinal)];
+    }
+
+    internal async Task<VaultHost> FindAsync(Guid entityId)
+    {
+        var listing = await ListAsync();
+
+        return listing.Hosts.SingleOrDefault(host => host.EntityId == entityId)
+            ?? throw new InvalidOperationException($"{Name} cannot see host {entityId}.");
+    }
+
+    internal Task<Guid> CreateAsync(HostSecret host) =>
+        Hosts.CreateAsync(SyncHarness.VaultId, host, TestContext.Current.CancellationToken);
+
+    internal Task UpdateAsync(Guid entityId, HostSecret host) =>
+        Hosts.UpdateAsync(SyncHarness.VaultId, entityId, host, TestContext.Current.CancellationToken);
+
+    internal Task DeleteAsync(Guid entityId) =>
+        Hosts.DeleteAsync(SyncHarness.VaultId, entityId, TestContext.Current.CancellationToken);
+
+    internal Task<IReadOnlyList<StoredConflict>> ConflictsAsync() =>
+        Conflicts.ListAsync(SyncHarness.VaultId, false, TestContext.Current.CancellationToken);
+
+    /// <inheritdoc />
+    public void Dispose()
+    {
+        Keyring.Dispose();
+        protector.Dispose();
+        master.Dispose();
+        factory.Dispose();
+    }
+}
+
+/// <summary>
+/// One user, one vault, two machines and a server.
+/// </summary>
+/// <remarks>
+/// Both devices share the identity bundle, which is what a single user on a laptop and a desktop
+/// actually looks like: one enrolled key pair, one vault grant, two independent local caches. That is
+/// also the cheapest realistic setup in which every conflict case can be produced.
+/// </remarks>
+internal sealed class SyncHarness : IDisposable
+{
+    internal static readonly Argon2Profile CheapProfile =
+        Argon2Profile.FromStoredParameters(memoryKibibytes: 8 * 1024, passes: 1, parallelism: 1);
+
+    private readonly UserSecretBundle bundle;
+
+    private SyncHarness(UserSecretBundle bundle, FakeVaultServer server, SyncDevice first, SyncDevice second)
+    {
+        this.bundle = bundle;
+        Server = server;
+        First = first;
+        Second = second;
+    }
+
+    internal static Guid VaultId { get; } = Guid.Parse("0192f0c8-7777-7c3d-8e4f-5a6b7c8d9e0f");
+
+    internal FakeVaultServer Server { get; }
+
+    /// <summary>The laptop.</summary>
+    internal SyncDevice First { get; }
+
+    /// <summary>The desktop.</summary>
+    internal SyncDevice Second { get; }
+
+    internal static async Task<SyncHarness> CreateAsync(SyncOptions? options = null)
+    {
+        var effective = options ?? SyncOptions.Default;
+
+        var identity = UserSecretBundle.Create(DateTimeOffset.FromUnixTimeSeconds(1_700_000_000));
+
+        try
+        {
+            var vaultKey = VaultKeys.Create();
+            var wrapped = VaultKeys.WrapTo(vaultKey, identity.EncryptionPublicKey, VaultId, 1);
+
+            // The plaintext key is not retained: each device unwraps the grant itself, as it would after
+            // an ordinary unlock.
+            System.Security.Cryptography.CryptographicOperations.ZeroMemory(vaultKey);
+
+            var vault = new StoredVault(
+                VaultId, "Personal", IsPersonal: true, TeamId: null, KeyGeneration: 1,
+                Permissions: 31, wrapped, RekeyRequired: false);
+
+            var server = new FakeVaultServer(VaultId);
+
+            var first = await SyncDevice.CreateAsync("laptop", identity, vault, server, effective);
+
+            try
+            {
+                var second = await SyncDevice.CreateAsync("desktop", identity, vault, server, effective);
+                return new SyncHarness(identity, server, first, second);
+            }
+            catch
+            {
+                first.Dispose();
+                throw;
+            }
+        }
+        catch
+        {
+            identity.Dispose();
+            throw;
+        }
+    }
+
+    /// <summary>Brings both devices up to date, twice, so the result is a settled state.</summary>
+    /// <remarks>
+    /// Twice because one pass per device is not enough for a change made on one to be merged on the
+    /// other and then pushed back. Asserting on a settled state rather than on an intermediate one is
+    /// what makes "the two devices converge" a meaningful claim.
+    /// </remarks>
+    internal async Task SettleAsync()
+    {
+        for (var round = 0; round < 2; round++)
+        {
+            await First.SyncAsync();
+            await Second.SyncAsync();
+        }
+    }
+
+    /// <inheritdoc />
+    public void Dispose()
+    {
+        First.Dispose();
+        Second.Dispose();
+        bundle.Dispose();
+    }
+
+    // ---- Builders ----
+
+    internal static HostSecret Host(
+        string label,
+        string hostname = "db.internal",
+        int port = 22,
+        string? username = "deploy",
+        string? notes = null,
+        (string Name, string Value)[]? options = null,
+        bool relayEnabled = false) =>
+        new()
+        {
+            Label = label,
+            Hostname = hostname,
+            Port = port,
+            Username = username,
+            Notes = notes,
+            Options = options is null
+                ? HostOptions.Empty
+                : HostOptions.Create(options.Select(o => new HostOption(o.Name, o.Value))),
+            RelayEnabled = relayEnabled,
+        };
+}