feat: add portable browser protocol surface

[mickvandijke]

Summary

Makes the compatibility-sensitive parts of ant-protocol available to browser/WASM clients and adds the shared post-quantum application session used by both the browser client and ant-node's WebRTC Direct listener.

The existing native surface remains the default. Browser consumers opt into the narrowly scoped portable feature and use the same quote encodings, payment hash, pricing curve, storage-commitment verification, transfer deadlines, cryptographic handshake, and encrypted record format as the node. This keeps protocol and cryptographic behavior in one Rust implementation instead of duplicating it in JavaScript or in separate client/server codecs.

What changes

Portable protocol surface

• Adds explicit native and portable feature surfaces; defaults preserve current native behavior.
• Moves transport, EVM-provider, runtime, and signing dependencies behind the native feature.
• Adds a FIPS-204 ML-DSA-65 verification backend for portable targets.
• Exposes portable quote and storage-commitment representations and signature verification.
• Implements the exact native EVM quote-payment Keccak-256 hash without depending on an EVM provider.
• Exposes the integer storage-price curve used by native quote processing.
• Shares payload-scaled, capped WebRTC transfer deadlines between the client and node.
• Keeps protocol framing and content-address types available to both native and WASM consumers.

Shared WebRTC post-quantum session

• The client creates an ephemeral ML-KEM-768 encapsulation key.
• The node encapsulates a fresh shared secret and signs a domain-separated transcript containing the client hello, KEM ciphertext, and ANT peer ID with its persistent ML-DSA-65 identity.
• The client verifies the expected peer ID, the BLAKE3 public-key-to-peer-ID binding, and the ML-DSA transcript signature before accepting the session.
• The shared secret and transcript hash derive independent client-to-server and server-to-client 256-bit keys.
• Every later browser RPC request and response is protected with ChaCha20-Poly1305.
• Ordered 64-bit per-direction sequence numbers prevent replay and reordering and ensure nonce uniqueness.
• A bounded four-byte outer length prefix allows encrypted records and handshake messages to be safely reassembled from DataChannel messages.
• Session key material is zeroized on drop, and malformed, unauthenticated, replayed, or out-of-order records fail closed.

Security boundary

WebRTC still authenticates the pinned DTLS certificate and supplies ICE/DTLS/SCTP transport. The new application session independently authenticates the ANT node identity and protects all RPC and chunk plaintext with ML-KEM-derived keys.

This is intentionally defense in depth:

• later compromise of only the classical DTLS key exchange is insufficient to decrypt recorded application payloads;
• compromise of only the DTLS certificate key is insufficient to impersonate the ANT node;
• packet sizes, timing, connection metadata, availability, and the WebRTC stack itself are not made post-quantum secure; and
• the handshake authenticates the node to the browser, not the browser user to the node. Client authority remains method-specific, such as the normal signed payment proof.

Compatibility

• Default features still select the existing native API, logging, signing, transport, and EVM behavior.
• Existing native QUIC wire behavior, stored-data formats, quote formats, and payment formats are unchanged.
• The browser application protocol moves from plaintext v3 to encrypted v4. v3/v4 peers deliberately fail closed; the node and browser client must be rolled out together.
• Existing native consumers such as ant-cli do not use this browser session and require no source changes.
• Downstream browser-support drafts pin commit 4dad14b until a reviewed release is available.

Test evidence

Current-head validation:

• cargo test --lib web_rtc::session --features native
  • 5 handshake, identity, bidirectional record, tamper/replay, and framing tests passed.
• cargo clippy --lib --features native -- -D warnings
• Downstream ant-core WASM check and clippy pass against the pushed Git revision.
• Downstream browser protocol tests: 4 passed.
• Downstream browser SDK build, typecheck, generated-WASM test, and unit tests: 8 passed.
• Coordinated five-node WebRTC Direct integration passed the encrypted handshake, HELLO, lookup, download, quote/payment proof, paid upload, and read-back path.
• git diff --check

Existing portable/native parity coverage also checks quote encoding, payment hashing, pricing, commitment validation, and ML-DSA verification.

Draft integration notes

• Linear issue: TBD before this stack is marked ready.
• This branch started from ant-protocol v2.3.1 and still needs rebasing onto the current target branch.
• Replace downstream Git pins with a reviewed release before merge.
• A real browser run against a matching deployed v4 node fleet remains required; the current live integration uses the real native WebRTC Direct test adapter plus the same shared protocol module.

Coordinated draft stack

• Transport: saorsa-transport#160
• Addresses/shared lookup: saorsa-core#158
• This portable/PQ protocol layer: ant-protocol#29
• Node/browser RPC: ant-node#220
• ant-core/WASM client: ant-client#186

Rollback

Consumers can continue using the default native surface. Removing the optional portable/browser session does not alter native QUIC behavior or existing stored data.