secrets: at-rest encryption, passphrase wrap, phone packaging

Seal items AES-256-GCM under a random store key (item id as AAD).
Machine wrap: HKDF over a deterministic machined signature (domain
secrets-store-key, socket /run/souveraine/machined.sock; legacy
seed-id fallback, same framing) — private key never enters the daemon.
Argon2id passphrase wrap slot (64MiB/3, HKDF-mixed with the machine
signature) managed via org.souveraine.Secrets.Manage: SetPassphrase /
VerifyPassphrase / HasPassphrase; rotation re-wraps only.

Client-found spec fixes: DH prime was the 2048-bit group-14 constant,
not the 1024-bit Second Oakley group libsecret uses (pinned by test);
item ids now simple UUIDs (hyphens illegal in object paths); collection
also served at /aliases/default; interfaces registered before name
claim. Added spec signals, real timestamps, content types, atomic 0600
store writes.

packaging: systemd user unit, D-Bus activation shadow, idempotent
phone deploy script (masks gnome-keyring, verifies round-trip).

packaging/souveraine-secrets.service

@@ -0,0 +1,22 @@
+# Souveraine Secret Service — the machine's org.freedesktop.secrets provider.
+# Claims the well-known name at session start (WantedBy=default.target) so no
+# client ever D-Bus-activates a different provider; the paired activation file
+# (org.freedesktop.secrets.service → SystemdService=) routes on-demand starts
+# here too. Requires souveraine-machined (system tier) or a legacy user seed;
+# refuses to start without a machine identity, by design.
+[Unit]
+Description=Souveraine Secret Service (org.freedesktop.secrets)
+Documentation=file:///usr/local/share/doc/souveraine/STORAGE-ENCRYPTION.md
+After=dbus.socket
+Requires=dbus.socket
+
+[Service]
+Type=dbus
+BusName=org.freedesktop.secrets
+ExecStart=/usr/local/bin/souveraine-secrets
+Restart=on-failure
+RestartSec=5
+Environment=RUST_LOG=info
+
+[Install]
+WantedBy=default.target