fix(auth): bind delete state in versioned op signatures

[marcus-pousette]

Problem

Defensive deletes use meta.knownState to decide which unseen descendant changes restore a subtree. Signature v1 does not cover those bytes, so an untrusted relay could change or remove them without invalidating the signature.

What changes

• Ordinary operations continue using the unchanged v1 signature.
• Delete and tombstone operations automatically use v2; the operation kind selects the version, so a relay cannot remove a version flag.
• V2 signs an explicit presence tag, byte length, and exact knownState bytes.
• Deletes require non-empty canonical version-vector JSON.
• Tombstones use v2's explicit absent-state form.
• Non-delete operations reject non-empty knownState.
• Deprecated public v1 sign/verify helpers fail closed for delete and tombstone operations.
• The raw v1 input encoder remains available for vectors and migration tooling.

Upgraded verifiers intentionally reject historical v1 delete/tombstone signatures because their causal state was never authenticated. Ordinary v1 operations remain compatible.

Fast paths

• Ordinary operations use exactly the existing v1 bytes and verification path.
• Only defensive-delete operations parse and validate canonical knownState.
• Generic signTreecrdtOp and verifyTreecrdtOp select the correct version automatically.

Scope and debloating

This rewrite removes the unrelated authored-time claims, protobuf changes, and proof-store schema changes from the original PR. The focused diff is 7 files, +372/-10.

Tests

• stable v1 and v2 signature vectors
• add/remove/mutate knownState invalidates signatures
• non-canonical persistent encodings are rejected
• delete/tombstone cannot use v1
• ordinary v1 signing and authenticated sync remain compatible

Stack

Stacked on #200, which preserves the exact defensive-delete state through SQLite persistence and reopen.