phase 6: web storage layer (KeyStore, Cache, session)

KeyStore + Cache TS interfaces with WebCrypto non-extractable Ed25519
keys persisted via IndexedDB (idb), plus thin api/session.ts that
loads or creates the device session at app startup. Vitest unit
tests under fake-indexeddb cover both adapters; Playwright e2e
verifies the keypair survives reload and produces signatures still
verifiable under the persisted public key (gateway round-trip moves
to Phase 7's existing acceptance bullet).

Browser baseline: WebCrypto Ed25519 — Chrome >=137, Firefox >=130,
Safari >=17.4. No JS fallback; ui/docs/storage.md documents the
matrix and the WebKit non-determinism quirk.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

ui/docs/wasm-toolchain.md

@@ -5,6 +5,10 @@ bytes, signature verification, keypair helpers) to WebAssembly via
 **TinyGo**. The compiled artefact `core.wasm` and its companion
 runtime shim `wasm_exec.js` ship under `ui/frontend/static/`.
 
+Real Ed25519 signing happens outside WASM in a platform-specific
+keystore — see [`storage.md`](storage.md) for the web implementation
+(WebCrypto non-extractable keys + IndexedDB).
+
 ## Why TinyGo
 
 Two viable Go-to-WASM toolchains exist: