Add ely_sync_client crate

Build the Rust counterpart to `ely-browser-cloud`: a Bearer-token
authenticated HTTP client with the JSON wire types for the worker's
device + snapshot routes.

What lands:
- `BearerToken` + `BearerTokenStore` so Better Auth sessions persist
  per profile data dir with atomic rename writes.
- `DeviceIdentity` (UUIDv7 + Ed25519-shaped public key, persisted
  alongside the token so the worker keeps the same `device_id` across
  restarts).
- `SyncApiClient` with `register_device`, `list_devices`,
  `upload_snapshot`, and `download_snapshot` over `ureq`, mapping the
  worker's strict error envelopes onto typed `SyncClientError`s.
- `SnapshotPayload` enforces the worker's 10 MiB / SHA-256-hash
  contract before the wire encode, so callers fail fast.

Out of scope for this commit: the BrowserCore integration that swaps
snapshots in and out, and the in-app Better Auth + device-approval UX.
Those land in subsequent commits — `cloudflare/src/api_controls.ts`
rejects sync from devices that aren't already approved, so first-use
also requires a one-shot D1 approval until that path exists in the UI.

crates/ely_sync_client/src/error.rs

@@ -0,0 +1,33 @@
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum SyncClientError {
+    #[error("API base URL is invalid: {url}")]
+    InvalidBaseUrl { url: String },
+
+    #[error("Bearer token storage is unavailable: {0}")]
+    TokenStorage(String),
+
+    #[error("HTTP request failed for {endpoint}: {source}")]
+    Http {
+        endpoint: String,
+        #[source]
+        source: Box<ureq::Error>,
+    },
+
+    #[error("HTTP {status} {endpoint}: {body}")]
+    HttpStatus { endpoint: String, status: u16, body: String },
+
+    #[error("JSON parsing failed for {endpoint}: {source}")]
+    Json {
+        endpoint: String,
+        #[source]
+        source: serde_json::Error,
+    },
+
+    #[error("Snapshot payload is too large: {bytes} bytes (max {limit})")]
+    SnapshotTooLarge { bytes: usize, limit: usize },
+
+    #[error("Snapshot base64 decode failed: {0}")]
+    SnapshotBase64(String),
+}