Release: consolidate VeyraKey v0.10

[Iamsujithd]

What changed

• consolidate the accumulated VeyraKey v0.10 password-manager, private-email, Google Drive, vault, and settings work
• separate Private Email, Cloud Sync, Import and Backup, and Vault Security surfaces
• add per-site plus aliases and optional SimpleLogin or Addy.io provider support
• clarify the native passkey boundary while retaining encrypted TOTP and public passkey references
• harden Google Drive restore, account switching, session state, exact-origin autofill, and archive restore behavior
• extend lifecycle, UI, integration, provider, autofill, and vault tests
• replace the previous 771-line README with an evidence-based product page, visual assets, Mermaid architecture, operating modes, security model, and release instructions

Why

The previous project state mixed implemented capabilities with aspirational claims, exposed stale test counts and dead links, and concentrated unrelated settings in one surface. This release aligns implementation, tests, documentation, and repository presentation around the verified v0.10 behavior.

User impact

• users can choose a device-only vault or a Google-connected encrypted vault
• signup aliases are generated per site and sync only after the matching credential is saved
• cloud settings and device enrollment now expose one contextual action instead of redundant controls
• documentation now distinguishes automated release evidence from external OAuth, store, biometric, and independent-review gates

Verification

• CI=true pnpm check
• 38 test files and 259 tests passed
• strict TypeScript passed across 13 workspace packages
• web, Chrome MV3, and Firefox MV3 production builds passed
• Chrome, Firefox, and source packages generated
• permission, CSP, source-map, embedded-secret, size, version-alignment, artifact, and SBOM checks passed
• local release status complete; 4 external public-release gates remain documented

Security boundary

VeyraKey remains a portfolio release candidate and is not independently audited. Native passkey private keys remain with the browser or OS authenticator. Live Google OAuth, browser-store signing, physical biometric coverage, and independent review remain explicit external gates.