Authenticated, scoped sync: signed requests and per-path subscriptions

- RequestAuth: clients sign `${timestamp}:${path}:${body}` (as in
  sync-server-example); headers carry public key, timestamp, signature and
  algorithm. Pluggable signers/verifiers; Ed25519 via WebCrypto built in.
  Timestamp window and replay protection.
- KVStorageHttpServer requires auth ('none' must be explicit). With auth, every
  key, scan range and subscription path must be under the caller's public key.
- POST /events with { paths }: subscribers only receive (and on resume only
  replay) changes under their authorized paths.
- KVStorageHttp: signer option; subscribe(path)/unsubscribe(path)/close()
  replace watch(); 401/403 reject instead of retrying.
- KVStorageComposite: prefix option scopes sync, cache and subscription.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Qxbkp4tA7G5SCWjzWuxmE

test/kv-storage/sync-helpers.ts

@@ -1,6 +1,7 @@
 import { KVStorageHttp } from '../../src/kv-storage/kv-storage-http.js'
 import { KVStorageHttpServer, type KVStorageHttpServerOptions } from '../../src/kv-storage/kv-storage-http-server.js'
 import { KVStorageInMemory } from '../../src/kv-storage/kv-storage-in-memory.js'
+import type { RequestSigner } from '../../src/utils/request-auth.js'
 import { KVStorageCounting } from '../helpers.js'
 
 /**
@@ -13,13 +14,14 @@ export class TestNetwork {
   readonly server: KVStorageHttpServer
   private readonly clients: KVStorageHttp[] = []
 
-  constructor(options: KVStorageHttpServerOptions = {}) {
-    this.server = new KVStorageHttpServer(this.store, options)
+  constructor(options: Partial<KVStorageHttpServerOptions> = {}) {
+    this.server = new KVStorageHttpServer(this.store, { auth: 'none', ...options })
   }
 
-  client(): KVStorageHttp {
+  client(signer?: RequestSigner): KVStorageHttp {
     const client = new KVStorageHttp({
       url: 'http://server',
+      signer,
       fetch: async (url, init) => {
         if (!this.online) throw new TypeError('fetch failed')
         return this.server.handle(new Request(url, init))
@@ -30,6 +32,6 @@ export class TestNetwork {
   }
 
   async close(): Promise<void> {
-    await Promise.all(this.clients.map((c) => c.unwatch()))
+    await Promise.all(this.clients.map((c) => c.close()))
   }
 }