feat(ext/setup): zxcvbn strength meter + score>=3 gate (audit H3)

Replaces the ad-hoc char-class passphraseStrength() with a 5-segment
bar backed by a SW round-trip to rate_passphrase (zxcvbn). Input
handler debounces 150ms so we don't hammer the worker per keystroke.

The create-vault button is disabled unless the last score is ≥ 3
(zxcvbn's "safely unguessable" threshold), and the handler re-rates
synchronously on click as defence-in-depth. Label flips between "Too
weak" (red) and "Strong enough" (green).

Also:
- rewrites the vault-creation path to use the typed-item unlock +
  manifest_encrypt APIs (derive_master_key/encrypt_manifest are gone);
  the new initial manifest is { schema_version: 2, items: {} }.
- wasm.d.ts is now a pure `declare module 'relicario-wasm'` block;
  tsconfig's stale `paths` alias is removed.
- @ts-nocheck removed from setup.ts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

extension/src/wasm.d.ts

@@ -1,61 +1,65 @@
 // Thin TypeScript declarations for the relicario-wasm bindings.
 // These are hand-written to mirror the #[wasm_bindgen] signatures in
 // crates/relicario-wasm/src/lib.rs; keep them in sync manually.
+//
+// Declared under the bare specifier 'relicario-wasm' so `typeof
+// import('relicario-wasm')` resolves in setup.ts. Webpack doesn't
+// actually resolve the module — setup.ts loads the auto-generated
+// wasm/relicario_wasm.js via a webpackIgnore dynamic import at runtime.
 
-export class SessionHandle {
-  readonly value: number;
-  free(): void;
+declare module 'relicario-wasm' {
+  export class SessionHandle {
+    readonly value: number;
+    free(): void;
+  }
+
+  export class EncryptedAttachment {
+    readonly aid: string;
+    readonly bytes: Uint8Array;
+    free(): void;
+  }
+
+  export class TotpCode {
+    readonly code: string;
+    readonly expires_at: bigint;
+    free(): void;
+  }
+
+  export function unlock(
+    passphrase: string,
+    image_bytes: Uint8Array,
+    salt: Uint8Array,
+    params_json: string,
+  ): SessionHandle;
+
+  export function lock(handle: SessionHandle): boolean;
+
+  export function manifest_decrypt(handle: SessionHandle, encrypted: Uint8Array): unknown;
+  export function manifest_encrypt(handle: SessionHandle, manifest_json: string): Uint8Array;
+  export function item_decrypt(handle: SessionHandle, encrypted: Uint8Array): unknown;
+  export function item_encrypt(handle: SessionHandle, item_json: string): Uint8Array;
+  export function settings_decrypt(handle: SessionHandle, encrypted: Uint8Array): unknown;
+  export function settings_encrypt(handle: SessionHandle, settings_json: string): Uint8Array;
+
+  export function attachment_encrypt(
+    handle: SessionHandle,
+    plaintext: Uint8Array,
+    max_bytes: bigint,
+  ): EncryptedAttachment;
+  export function attachment_decrypt(handle: SessionHandle, encrypted: Uint8Array): Uint8Array;
+
+  export function new_item_id(): string;
+  export function new_field_id(): string;
+
+  export function generate_password(request_json: string): string;
+  export function generate_passphrase(request_json: string): string;
+  export function rate_passphrase(p: string): { score: number; guesses_log10: number };
+
+  export function extract_image_secret(image_bytes: Uint8Array): Uint8Array;
+  export function embed_image_secret(carrier: Uint8Array, secret: Uint8Array): Uint8Array;
+
+  export function totp_compute(config_json: string, now_unix_seconds: bigint): TotpCode;
+
+  export default function init(module_or_path?: unknown): Promise<void>;
+  export function initSync(args: { module: WebAssembly.Module }): void;
 }
-
-export class EncryptedAttachment {
-  readonly aid: string;
-  readonly bytes: Uint8Array;
-  free(): void;
-}
-
-export class TotpCode {
-  readonly code: string;
-  readonly expires_at: bigint;
-  free(): void;
-}
-
-export function unlock(
-  passphrase: string,
-  image_bytes: Uint8Array,
-  salt: Uint8Array,
-  params_json: string,
-): SessionHandle;
-
-export function lock(handle: SessionHandle): boolean;
-
-export function manifest_decrypt(handle: SessionHandle, encrypted: Uint8Array): unknown;
-export function manifest_encrypt(handle: SessionHandle, manifest_json: string): Uint8Array;
-export function item_decrypt(handle: SessionHandle, encrypted: Uint8Array): unknown;
-export function item_encrypt(handle: SessionHandle, item_json: string): Uint8Array;
-export function settings_decrypt(handle: SessionHandle, encrypted: Uint8Array): unknown;
-export function settings_encrypt(handle: SessionHandle, settings_json: string): Uint8Array;
-
-export function attachment_encrypt(
-  handle: SessionHandle,
-  plaintext: Uint8Array,
-  max_bytes: bigint,
-): EncryptedAttachment;
-export function attachment_decrypt(handle: SessionHandle, encrypted: Uint8Array): Uint8Array;
-
-export function new_item_id(): string;
-export function new_field_id(): string;
-
-export function generate_password(request_json: string): string;
-export function generate_passphrase(request_json: string): string;
-export function rate_passphrase(p: string): { score: number; guesses_log10: number };
-
-export function extract_image_secret(image_bytes: Uint8Array): Uint8Array;
-export function embed_image_secret(carrier: Uint8Array, secret: Uint8Array): Uint8Array;
-
-export function totp_compute(config_json: string, now_unix_seconds: bigint): TotpCode;
-
-// Initializer (wasm-bindgen's default init function).
-export default function init(module_or_path?: unknown): Promise<void>;
-
-// wasm-bindgen's sync init — Chrome MV3 service workers can't use dynamic import().
-export function initSync(args: { module: WebAssembly.Module }): void;