Derived X-Wing: device-side decapsulation; drop vault and password generator from production

[0c-coder]

Web-app half of the PQC derived-key work in libraries#6.

The device holds both halves now. It used to return a 32-byte ML-KEM seed and let the browser expand it, run ML-KEM decapsulation and combine. The seed is private key material — it yields sk_M — so a request for a public key was answered with a private one, and the ML-KEM half of a hardware key really lived in the page.

• DERIVE_PUBLIC_KEY returns the whole 1216-byte recipient (pk_M || pk_X) instead of [pk_X(32) | mlkem_seed(32)]. ML-KEM has no short public key — the only 32-byte value reproducing pk_M also reproduces sk_M — so the public key itself has to cross the wire. It no longer fits one WebAuthn assertion, so the head arrives with the OKCONNECT reply and the rest is polled through send_stored_response() as an ML-DSA-65 signature already is.
• Decapsulation leaves the DERIVE_* extension entirely: a chunked OKDECRYPT to slot 128 carrying [label32 | ct(1120)], the same tunnel composite_decrypt uses, answered with the finished 32-byte shared secret.

So age_pqc.js loses mlkemKeypairFromSeed(), buildRecipient(), splitDecapsulate() and ctXOf() — nothing calls them, and what remains is host/sender-side math on public values. age-derive.js drops the recipient lookup it only needed to feed splitDecapsulate().

Also removed: press_required and the precomputed challenge code. The REQ_PRESS opcodes are gone from the firmware, and whether a confirmation is required now follows from what is being asked for — a public key never, a shared secret always, enforced device-side. The code we precomputed hashed [keytype | label32 | ct_X32], which is not what the device hashes any more.

Separately: the credential vault and password generator are dropped from production builds. The vault is prerelease and has never shipped; the password generator page has never worked. The vault moves to plugins-devel.js; three dead links come out of index-src.html.

Depends on libraries#6. Untested against hardware — the FIDO2 derive path is still under investigation.

[0c-coder]

Two more removals pushed to this branch:

• 740f1c9 — deleted src/lib/history.js. Dead: its only caller was plugins-devel.js, and that call passed 2 arguments to a 4-argument signature.
• 024a2a2 — dropped the credential vault from production. plugins.js no longer registers it; plugins-devel.js does instead, so development builds keep it while webpack leaves it out of the production bundle. Also removed three links from index-src.html: the Vault nav link, the Credential Vault tool card, and the Password Generator tool card — password-generator was already devel-only, so that card had been a dead link in production regardless.

The vault is prerelease and has never shipped, and neither the vault nor the password generator page has ever worked.