guest-sdk: rework the public interface from external feedback

[lann]

Reworks the lann-webcrypto-guest public interface per external review feedback. No WIT changes; the component ABI and all cross-implementation behavior are untouched.

Changes

• raw → bindings: the generated-bindings escape hatch follows ecosystem convention (wasip3-style). from_raw/as_raw/into_raw keep their names.
• mint flattened into the root: lann_webcrypto_guest::hmac_sha2::generate_key(...) etc. — one root module per algorithm interface, mirroring the WIT layout, no more jargon module name.
• Newtype names: MacKey→Mac, AeadKey→Aead, InternalNonceKey→AeadInternalNonce. SigningKey/VerifyingKey deliberately keep Key: the RustCrypto precedent for stripping it (hmac::Mac, aead::Aead) applies to algorithm-instance objects, while ed25519-dalek and the ecdsa crate keep exactly these signature-key names.
• Crate-owned #[non_exhaustive] Error mirroring the WIT variants plus an unconditional Read(std::io::Error) variant for failing local producers (the variant is unconditional — only its producer is feature-gated — to avoid the feature-unification semver trap). From<bindings::types::Error>, Display, Error::source.
• Generalized inputs: operations take impl Into<DataSource> — &[u8]/&[u8; N]/Vec<u8>/&Vec<u8> (buffered), StreamReader<u8> (passed through without a local feeder), DataSource::from_buf (feature bytes), DataSource::from_reader (feature futures-io). Blanket impls over Buf/AsyncRead are impossible (&[u8] implements both), hence explicit adapters. A reader failure wins over the operation's own result, which was computed over a truncated input.
• seal/open return StreamReader<u8>: trivial to collect().await, and unlocks forwarding without buffering. open's docs carry the contract that the stream is handed back only after the tag verifies.
• Docs: algorithm_* getters link the W3C WebCrypto algorithm registry and name the projected spec fields; security-critical WIT contracts (nonce uniqueness, fail-closed verify, unverified-plaintext-never-observable, truncating producers) are duplicated into the method docs; WIT-style refs replaced with intra-doc links; pub use wit_bindgen; (wasip3 precedent).
• constant_time_equal stays a component import (considered and rejected switching to an in-guest constant_time_eq re-export): the import lets the host perform the comparison in native code where constant-time properties actually hold; the ABI transit is negligible. Now documented on the function.

Consumers (examples/crypto-demo, conformance/guest, conformance/signing-guest) updated; crypto-demo's hmac-key-export check now exercises the new wrapper layer.

Advances (does not close) the guest-side convenience libraries item of #35.

Verification

• just check — pass (fmt, clippy incl. wasm target, validate-wit, tests incl. guest-under-Wasmtime)
• just test-webcrypto-composed — 22/22 checks
• just conformance-wasmtime + just conformance-composed — 6226 cases + 5 signing cases, 0 failed
• just transpile — pass
• cargo check/clippy/doc on wasm32-wasip2 under all four feature combos — clean
• jco-node/jco-browser conformance could not run locally (Node 20 here; JSPI needs Node 24+) — relying on CI. Risk is low: the WIT surface and component ABI are unchanged.