feat(settings): compose the passkey wrap envelope create and unwrap

[vpomerleau]

Because

• Passwordless Sync unlocks Sync with a passkey alone, which needs a client that
  can seal kB to a passkey and recover it from the stored envelope.
• The HPKE and AES-GCM primitives already landed, but nothing composed them into
  the envelope the wrap endpoints store and return.

This pull request

• Adds createWrapEnvelope and openWrapEnvelope, typed against the auth-client
  PasskeyWrapEnvelope.
• Exports only those two; the crypto layers and the context construction stay
  module-local.
• Binds uid and credentialId as length-prefixed framing, leaving the HPKE
  aad empty.
• Removes context.ts, folding its framing and validation into envelope.ts.
• Zeroes the recipient private key and the serialised scalar after use.
• Pins the frozen context bytes with a byte-exact assertion in
  golden-envelope.test.ts.

Issue that this pull request solves

Closes: FXA-13147

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Key files/areas to focus on: envelope.ts — it is the entire public surface.
• Suggested review order: envelope.ts, then golden-envelope.test.ts, then README.md.
• Risky or complex parts: the context bytes bound into both layers. They are
  un-migratable once a wrap is stored.

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

• The AAD here is length-prefixed framing of uid and credentialId with
  per-layer domain labels, not the delimited '${uid}-${credentialId}-prf-kb-wrap'
  string in the ticket's AC. The ticket flagged that delimiter as the thing to pin
  down; framing resolves it, since credentialId is authenticator-chosen and
  variable-length.
• The envelope has no version field, so the format freezes the first time a shipped
  client writes a wrap. Nothing consumes this module yet — which is also the only
  window in which v1-envelope-fixture.json can be regenerated.