Fix X3DH + add web client served by warzone-server

X3DH fix:
- Added identity_encryption_key (X25519) to PreKeyBundle
- initiate() and respond() now use correct DH operations per Signal spec:
  DH1=IK_a*SPK_b, DH2=EK_a*IK_b, DH3=EK_a*SPK_b, DH4=EK_a*OPK_b
- All 17 tests pass including x3dh_shared_secret_matches

Web client (served at /):
- Identity generation with seed (stored in localStorage)
- Recovery from hex-encoded seed
- Auto-load saved identity on page load
- Fingerprint display (same format as CLI: xxxx:xxxx:xxxx:xxxx)
- Key registration with server via /v1/keys/register
- Chat UI with message polling (5s interval)
- Commands: /help, /info, /seed
- Dark theme matching warzone aesthetic

Both clients (CLI + Web) now exist:
- CLI: warzone init, warzone info, warzone recover
- Web: http://localhost:7700/ (served by warzone-server)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

warzone/crates/warzone-server/src/routes/mod.rs

@@ -1,6 +1,7 @@
 mod health;
 mod keys;
 mod messages;
+mod web;
 
 use axum::Router;
 
@@ -12,3 +13,8 @@ pub fn router() -> Router<AppState> {
         .merge(keys::routes())
         .merge(messages::routes())
 }
+
+/// Web UI router (served at root, outside /v1)
+pub fn web_router() -> Router<AppState> {
+    web::routes()
+}