Signed requests: X-Nonce header; composite: sync skips unconfirmed writes

- Requests carry a random X-Nonce, signed as ${timestamp}:${nonce}:${path}:${body}. The
  server rejects a nonce the same key already used within the timestamp window. Identical
  requests at the same moment (two tabs, parallel reads) are now distinct, replacing the
  per-process increasing-timestamp workaround.
- Composite: a sync no longer reverts keys with local writes the source hasn't confirmed
  yet (in flight or queued); they briefly disappeared when a sync's scan ran before the
  write reached the source. Pending keys are reloaded from a persistent queue on start.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Qxbkp4tA7G5SCWjzWuxmE

README.md

@@ -239,10 +239,11 @@ key a value is stored under is authenticated too, so the server can't move value
 
 ### Signed requests
 
-Every request is signed with the user's key: `X-Public-Key`, `X-Timestamp`, `X-Signature` and
-`X-Signature-Algorithm` headers, over `${timestamp}:${path}:${body}`. The server checks the
-signature and a 60 s timestamp window (with replay protection), then that every key is the public
-key or under it. Ed25519 is built in (WebCrypto); other algorithms plug in by implementing
+Every request is signed with the user's key: `X-Public-Key`, `X-Timestamp`, `X-Nonce` (random
+per request), `X-Signature` and `X-Signature-Algorithm` headers, over
+`${timestamp}:${nonce}:${path}:${body}`. The server checks the signature, a 60 s timestamp
+window and that the nonce wasn't used before (replay protection), then that every key is the
+public key or under it. Ed25519 is built in (WebCrypto); other algorithms plug in by implementing
 `RequestSigner` / `SignatureVerifier`.
 
 ### Live updates without the composite