Because:
* Passkey PRF-derived keys need an HPKE envelope to wrap account keys
client-side.
This commit:
* Adds packages/fxa-settings/src/lib/passkey-crypto with HPKE seal/open
and key-wrap helpers, the shared ciphersuite in suite.ts, RFC 9180 A.6
test vectors, and unit tests.
* Stores skR as the raw scalar (Nsk 66) rather than a pkcs8 export, so
every stored length is a ciphersuite constant. pkcs8's 241 bytes rest
on Web Crypto emitting an OPTIONAL public-key field, and a conforming
implementation that omitted it would be zero-padded into the
fixed-width column and never open again. Serialising is left to the
library, which pads short scalars: ~1 P-521 key in 512 has a leading
zero byte, so a stripping implementation would corrupt those wraps
undetectably. Covered by a regression test.
* Keeps openKb taking pkR alongside the private key, so the library never
derives it via crypto.subtle.getPublicKey, whose fallback needs an
extractable key and fails only in browsers lacking the method.
* Adds the hpke dependency and allows it through Jest's
transformIgnorePatterns.