feat(crypto): Argon2id KDF foundation (vendored, not yet adopted)

Phase 1 of CODE_AUDIT §1.2 — additive, no live account uses Argon2id yet.

- Vendor @noble/hashes@2.2.0 argon2id as js/argon2.js (esbuild IIFE exposing
  globalThis.NobleArgon2). Pure-JS, not WASM: CSP is script-src 'self' with no
  wasm-unsafe-eval, so WASM would require weakening it. Verified against the
  RFC 9106 §5.3 test vector. Server needs zero Argon2 (zero-knowledge: it only
  ever SHA256-wraps the client verifier).
- app.js: deriveKeyBytes(pwd, salt, algo, iters, argonParams) branches Argon2id
  vs PBKDF2; deriveKeyAndVerifier refactored around it. New markers
  HASH_ALGO_ARGON2='argon2id-v2' + ARGON2_DEFAULT_PARAMS (OWASP m=19MiB,t=2,p=1,
  ~0.65s/unlock). isDecoupledVerifierAlgo() generalises the decoupled-verifier
  rule to any '-v2' scheme so argon2id-v2 inherits it. AES key is still ALWAYS
  the raw KDF output → entries decryptable, legacy accounts untouched.
- index.html loads js/argon2.js before app.js; added to BuildAssets whitelist;
  test harness loads it into the sandbox first.
- Tests: +5 (RFC 9106 vector via vendored bundle, argon2 branch derives Argon2
  key not PBKDF2, decoupled verifier, AES round-trip under Argon2 key). 40/40.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

js/tests/harness.js

@@ -113,6 +113,12 @@ function loadApp(overrides = {}) {
 
     vm.createContext(sandbox);
 
+    // Load the vendored Argon2 bundle first (index.html loads it before
+    // app.js). It assigns globalThis.NobleArgon2 — needed by the argon2id
+    // KDF branch in deriveKeyBytes.
+    const ARGON2_JS = path.join(__dirname, '..', 'argon2.js');
+    vm.runInContext(fs.readFileSync(ARGON2_JS, 'utf8'), sandbox, { filename: 'argon2.js' });
+
     let src = fs.readFileSync(APP_JS, 'utf8');
 
     // Export epilogue — surface the lexical (const) symbols we test, plus a
@@ -124,8 +130,10 @@ function loadApp(overrides = {}) {
         // crypto
         bytesToHex, hexToBytes: (typeof hexToBytes !== 'undefined' ? hexToBytes : undefined),
         verifierFromKeyHex, deriveKeyAndVerifier, computeVerifier,
+        deriveKeyBytes, isDecoupledVerifierAlgo,
         encryptPwd, decryptPwd, sha256Hex,
-        HASH_ALGO_V2, AUTH_VERIFIER_DOMAIN,
+        HASH_ALGO_V2, HASH_ALGO_ARGON2, AUTH_VERIFIER_DOMAIN, ARGON2_DEFAULT_PARAMS,
+        NobleArgon2: (typeof NobleArgon2 !== 'undefined' ? NobleArgon2 : undefined),
         // csv
         parseCSV, findColumn, parseEntriesFromCSV,
         // strength