feat: unify NFC, RAIN and DNA authentication

[the-code-learner]

Summary

This PR resets the development baseline to 0.0.1 and replaces the EPC-first model with a generic tag/security architecture.

Domain and storage

• generic (technology, identifier) tag registry for NFC and RAIN/UHF
• multiple tags per inventory item
• mixed inventory observations and immutable tag events
• current + permanent/once-opened tamper state
• legacy UHF data migration into the generic model

NFC / DNA security

• capability catalog for generic NFC/RAIN, NXP NTAG 223/224 DNA, StatusDetect, NTAG 424 DNA/TagTamper, Identiv DNA families, UCODE DNA/Track and UCODE Guard
• self-hosted AES-CMAC primitives
• NTAG 22x SUN verification and StatusDetect decoding
• NTAG 424 SDM verification including encrypted PICC data
• replay detection using verified read counters
• server-side key references loaded from mounted secret storage; no AES key material in DB/API/UI/MCP
• reader-bridge contract for low-level NFC and authenticated RAIN operations

Interfaces

• technology-aware REST APIs for tags, observations, events and verification
• stdio MCP server exposing the same domain surfaces
• Web NFC adapter for supported Android browsers
• full operational UI refactor using dense enterprise dashboard principles

Delivery discipline

• version baseline 0.0.1
• CHANGELOG.md
• GitHub Actions gate: npm test + npm run build
• release tag intentionally deferred until after a reviewed merge

Hardware note

No USB NFC or authenticated RAIN reader model is selected yet. Web NFC covers NDEF/SUN/SDM point workflows where supported; mutual-auth/protected-memory and UCODE DNA reader challenge-response remain behind the reader-bridge abstraction until hardware is selected.

Validation

• cryptographic unit tests added
• GitHub Actions tests green on final head
• GitHub Actions build green on final head
• ready for review after CI passes