Add ely_sync_client crate

Build the Rust counterpart to `ely-browser-cloud`: a Bearer-token
authenticated HTTP client with the JSON wire types for the worker's
device + snapshot routes.

What lands:
- `BearerToken` + `BearerTokenStore` so Better Auth sessions persist
  per profile data dir with atomic rename writes.
- `DeviceIdentity` (UUIDv7 + Ed25519-shaped public key, persisted
  alongside the token so the worker keeps the same `device_id` across
  restarts).
- `SyncApiClient` with `register_device`, `list_devices`,
  `upload_snapshot`, and `download_snapshot` over `ureq`, mapping the
  worker's strict error envelopes onto typed `SyncClientError`s.
- `SnapshotPayload` enforces the worker's 10 MiB / SHA-256-hash
  contract before the wire encode, so callers fail fast.

Out of scope for this commit: the BrowserCore integration that swaps
snapshots in and out, and the in-app Better Auth + device-approval UX.
Those land in subsequent commits — `cloudflare/src/api_controls.ts`
rejects sync from devices that aren't already approved, so first-use
also requires a one-shot D1 approval until that path exists in the UI.

crates/ely_sync_client/src/lib.rs

@@ -0,0 +1,37 @@
+//! HTTP client for the `ely-browser-cloud` Cloudflare worker.
+//!
+//! The worker exposes the device-bound sync API documented in
+//! `cloudflare/src/sync_*.ts`. This crate is the renderer-side counterpart:
+//! it owns the Better Auth bearer token, the locally-generated device
+//! identity, and the JSON wire types needed to push and pull the user's
+//! browser state.
+//!
+//! Scope today:
+//! - Bearer-token authenticated requests via `ureq`.
+//! - Device registration (`POST /api/devices/register`) and listing
+//!   (`GET /api/devices`).
+//! - Sync snapshot upload (`POST /api/sync/snapshot`) and download
+//!   (`GET /api/sync/snapshot?snapshot_id=…`).
+//!
+//! Intentionally omitted (kept for follow-up work, not papered over here):
+//! - The full Better Auth handshake (email + OTP / OAuth). Callers obtain
+//!   the bearer token out-of-band and hand it to the client.
+//! - First-device approval bootstrap. The Cloudflare API rejects sync from
+//!   an unapproved device; the user must approve a freshly-registered
+//!   device from another already-approved device (or via direct D1
+//!   operation), exactly as the backend enforces.
+//! - Incremental change-log push/pull (`/api/sync/push` and `/api/sync/pull`).
+//!   The snapshot path is the simplest contract that round-trips the user's
+//!   entire state, so we start there.
+
+pub mod auth;
+pub mod client;
+pub mod device;
+pub mod error;
+pub mod snapshot;
+
+pub use auth::{BearerToken, BearerTokenStore};
+pub use client::{ApiClientConfig, SyncApiClient};
+pub use device::{DeviceIdentity, DeviceListResponse, DeviceRecord, DeviceRegistration};
+pub use error::SyncClientError;
+pub use snapshot::{SnapshotDownload, SnapshotPayload, SnapshotUploadRequest};