[P5][MESH-01] Encrypted sync, pairing and key recovery

Programme: #1
Epic: #31

## Objective
Synchronize user-owned workspaces/preferences/artifacts across explicitly paired devices without giving the sync service plaintext authority or silently merging permissions/approvals.

## Scope
- Device/user identity keys and explicit pairing flow.
- End-to-end encrypted sync envelopes for eligible metadata/artifacts.
- Per-record sync scope and exclusion of non-portable credentials/session state.
- Conflict handling appropriate to data type; CRDT/merge only where semantics are safe.
- Backup/export/recovery-key flow and key rotation.
- Device inventory, last-seen, revocation and key retirement.
- Incremental sync, resume and bandwidth/storage policy.
- Sync migration/version compatibility.

## Security/correctness rules
- Permissions/approvals/financial reservations are not last-write-wins data.
- Revoked devices lose access to newly encrypted state.
- Credential/session transfer requires a separate explicit supported mechanism, not generic workspace sync.

## Acceptance criteria
- [ ] Paired devices exchange eligible state encrypted end-to-end according to design.
- [ ] Revoked device cannot decrypt/fetch newly authorized state after key transition.
- [ ] Layout/note conflicts merge or surface safely without silently overwriting authority records.
- [ ] Credentials and blanket approvals are absent from ordinary sync payloads.
- [ ] Recovery-key exercise restores eligible workspace data to a clean device.
- [ ] Corrupt/old sync records cannot downgrade policy/schema silently.

## Dependencies
- SEC-03
- UI-04

**First phase:** P5
**Maturity target:** P6
**Owner:** platform

Start by reviewing the dependency issues SEC-03 and UI-04, then map the stated scope for pairing, encrypted envelopes, conflict handling, recovery, revocation, and migration. Done means the acceptance criteria are addressed without transferring credentials or silently overwriting authority records; the payload names no files or tests.

Written by the indexing model from the issue text.