feat: add signing, totp & raw-mode AEAD/KDF/HMAC primitives (Phase 5)

[devin-ai-integration]

Summary

Phase 5 of the Singra → DIS crypto extraction. Phases 0–4 moved all data encryption (vault, PQ, file/attachment) into @dis/shield. This adds the remaining non-encryption primitives that Vault & Premium still call directly (op-log signing/hashing, auth, integrity HMAC, device-key/passkey KDF, secure random, TOTP) so both apps can drop every direct crypto.subtle / hash-wasm call. Wire formats are pinned byte-for-byte so no stored data migrates.

New subpath exports @dis/shield/signing and @dis/shield/totp; existing /integrity, /kdf, /aead, /random and /core gain helpers. Barrel (@dis/shield) re-exports all of them.

New surfaces:

// signing — ECDSA P-256 / SHA-256, raw r||s (64 bytes), SPKI pubkeys, non-extractable priv
generateEcdsaP256KeyPair(): { privateKey, publicKey, publicKeySpki }
importEcdsaP256PublicKeySpki(spki); signEcdsaP256(priv, data); verifyEcdsaP256(pub, sig, data)

// totp — RFC 6238 via otpauth, pinned SHA1/6-digit/30s/160-bit (matches enrolled secrets)
generateTotpSecret(); buildTotpUri({issuer,label,secret}); verifyTotpCode(secret, code, window=1)

// integrity — sha256Bytes/Base64/Base64Url/Hex, sha1Hex (HIBP interop only),
//             hmacSha256(key,data) + hmacSha256WithKey + importHmacSha256Key
// kdf — argon2idRaw({password,salt,memorySize,iterations,parallelism,hashLength}),
//        deriveHkdfSha256Bits(ikm,{info,salt?,lengthBits?}), deriveHkdfAesGcmKey(ikm,{info,salt?})
// aead — raw-mode: aesGcmEncrypt(key,nonce,pt,aad?)->ct||tag, aesGcmDecrypt(...),
//        importAesGcmRawKey, generateAesGcmKey   (caller owns the nonce)
// random — randomInt(min,max) rejection-sampled bias-free; fillRandom(view)
// core/encoding — bytesToBase64Url / base64UrlToBytes / bytesToHex

sha1Hex is documented as legacy-interop-only (HaveIBeenPwned k-anonymity); the SHA-1 inside TOTP is the standard RFC-6238 HMAC. Raw-mode AEAD exists because op-log records/snapshots store nonce and ciphertext as separate fields and bind binary AAD, unlike the high-level base64(IV||ct) helpers.

Tests

+30 tests (96 total, all green; typecheck/lint/build green). Known-answer vectors: SHA-256/SHA-1 of "abc", RFC 4231 HMAC case 1; otpauth round-trip interop; randomInt range + full-coverage + bias bounds; raw-AEAD AAD-binding and tamper rejection; ECDSA tamper/wrong-key/bad-length rejection; Argon2id & HKDF determinism + salt-sensitivity.

Link to Devin session: https://app.devin.ai/sessions/24b35de4890f41edb8a0250d5f4aba7c
Requested by: @einmalmaik

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring