#28 Document browser WASM unlock design

[bsutton]

Summary

• document the browser/WASM unlock trust model separately from native vault secret stores
• define prompt-only as the default browser mode and IndexedDB/WebCrypto as opt-in persistent unlock state
• record WebAuthn/passkey boundaries, disable/forget controls, and open questions

Validation

• cargo fmt --manifest-path rust/Cargo.toml --all --check
• cargo test --workspace --manifest-path rust/Cargo.toml (fails: lockbox_core api_tests::toc_round_trips_when_toc_payload_exceeds_minimum_page_body under current local ruzstd dependency)
• cargo test -p lockbox_core api_tests::toc_round_trips_when_toc_payload_exceeds_minimum_page_body --manifest-path rust/Cargo.toml -- --exact --nocapture (same failure)