test(crypto): add dedicated signatures coverage (RFC 8032 + tombstone regression)

[h4yfans]

Closes Phase 1 §1.3 of .claude/plans/tech-debt-remediation.md.

Summary

Adds a dedicated test file for signatures.ts (previously only tangential coverage in foundation.test.ts). Includes RFC 8032 golden vector + load-bearing tombstone regression that prevents server-forged deletions.

New tests (8)

1. RFC 8032 §7.1 TEST 1 golden vector — bit-exact pubkey + signature match
2. signPayload determinism for fixed seed+payload
3. Truncated signature → verifySignature returns false
4. Forged signature (key A signs, key B's pubkey verifies) → false
5. Wrong-pubkey verification → false
6. Tombstone strip regression: signed payload with deletedAt → stripping the field breaks verification (prevents server-forged deletion per MEMORY.md)
7. Mutating deletedAt to earlier timestamp → verify fails
8. Signature covers exact CBOR-encoded bytes (uses CBOR_FIELD_ORDER.TOMBSTONE)

Test plan

• pnpm --filter desktop test --project main src/main/crypto/signatures.test.ts — 0 failures
• per-file coverage on signatures.ts ≥ 95% (file is 22L, 2 fns — should land at 100%)
• pnpm typecheck:node && pnpm typecheck:web clean
• pnpm lint clean

🤖 Generated with Claude Code