Add encryption, Chromium tests and a README

- KVStorageEncrypted: AES-GCM per value (fresh IV, storage key as AAD), keys stay
  readable; decrypts and re-emits pushed changes and passes subscriptions through, so it
  can be a composite source. generateKey / exportKey / importKey / deriveKey (PBKDF2).
- KVStorageHttpServer: allowOrigins (CORS), including cache-control for SSE preflights.
- Chromium tests (Vitest browser mode + Playwright) against a real cross-origin server:
  conformance for IndexedDB, encrypted, HTTP and composite stores; signed requests and
  SSE; two devices syncing, offline writes surviving a reload. New CI job.
- Composite fixes found by those tests: sync() during a running sync schedules one more
  (changes between the first scan and the stream connecting were missed); a queued write
  the source refuses is dropped, restored and reported (onError) instead of blocking the
  queue forever.
- README with examples, mirrored in test/readme.test.ts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Qxbkp4tA7G5SCWjzWuxmE

CLAUDE.md

@@ -7,10 +7,14 @@ Layered TypeScript storage library: KV → Events → Documents. The design is i
 
 - `npm test`: `tsc --noEmit`, then all Vitest tests (including `test/types.test-d.ts`)
 - `npm run test:only -- <file>`: Vitest only
+- `npm run test:browser`: `test/browser/` in headless Chromium (Vitest browser mode + Playwright)
+  against a real server on another origin (`test/browser/global-setup.ts`)
 - `npm run typecheck`, `npm run build`, `npm run bench`
 - `npm run format` / `npm run format:check`: Prettier
 
-CI (`.gitea/workflows/ci.yml`, Gitea Actions) runs the format check, typecheck, tests and build on Node 22, 24 and 26.
+CI (`.gitea/workflows/ci.yml`, Gitea Actions) runs the format check, typecheck, tests and build on
+Node 22, 24 and 26, and the Chromium tests. On pushes it then publishes to the staging registry
+(`scripts/publish.mjs`: `main` → `latest`, `next` → `next`, others → `dev-<branch>`).
 
 ## Conventions
 
@@ -23,6 +27,7 @@ CI (`.gitea/workflows/ci.yml`, Gitea Actions) runs the format check, typecheck,
   object or in Maps (see `KVStorageComposite`, `KVStorageHttp`).
 - No runtime dependencies; third-party code is vendored (`src/utils/sse-session/`, `event-emitter.ts`,
   `extended-json.ts`, with a header naming the source). Tests live only in `test/`, mirroring `src/`.
+- `README.md` examples are mirrored in `test/readme.test.ts`; change both together.
 - New KV/document implementations must pass `test/kv-storage/kv-storage.conformance.ts` /
   `test/document-storage/document-storage.suite.ts`.
 - Ask the owner before pushing.