Add encrypted key support for chat and nodes

Introduces encrypted private key storage for nodes and users, updates chat message schema to support sender-side encryption, and adds supporting libraries and tests for cryptographic signing and identity unlock flows. Includes new database migrations, API route updates, and React components for identity unlock prompts.

drizzle/0009_add_node_private_key.sql

@@ -0,0 +1,2 @@
+-- Add private_key_encrypted column to nodes table for cryptographic signing
+ALTER TABLE "nodes" ADD COLUMN "private_key_encrypted" text;

drizzle/0009_sweet_chat.sql

@@ -0,0 +1,21 @@
+CREATE TABLE "remote_identity_cache" (
+	"did" text PRIMARY KEY NOT NULL,
+	"public_key" text NOT NULL,
+	"fetched_at" timestamp NOT NULL,
+	"expires_at" timestamp NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "signed_action_dedupe" (
+	"action_id" text PRIMARY KEY NOT NULL,
+	"did" text NOT NULL,
+	"nonce" text NOT NULL,
+	"ts" bigint NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "chat_messages" ADD COLUMN "sender_encrypted_content" text;--> statement-breakpoint
+ALTER TABLE "chat_messages" ADD COLUMN "sender_chat_public_key" text;--> statement-breakpoint
+ALTER TABLE "nodes" ADD COLUMN "private_key_encrypted" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "chat_public_key" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "chat_private_key_encrypted" text;--> statement-breakpoint
+CREATE INDEX "signed_action_dedupe_created_idx" ON "signed_action_dedupe" USING btree ("created_at");

drizzle/meta/_journal.json

@@ -64,6 +64,13 @@
       "when": 1769453302714,
       "tag": "0008_illegal_carlie_cooper",
       "breakpoints": true
+    },
+    {
+      "idx": 9,
+      "version": "7",
+      "when": 1769562092857,
+      "tag": "0009_sweet_chat",
+      "breakpoints": true
     }
   ]
 }