task(passkey): Add passkeyWraps model, repository and service

[nshirley]

Because

• The wrap endpoints (FXA-13142) need to read and write passkeyWraps.
• A corrupted envelope cannot be reconstructed, so every fixed-width binary field has to round-trip untouched.

This pull request

• Adds PasskeyWraps to the kysely types with its Selectable/Insertable types, a factory, and an integration-test fixture.
• Adds the wrap repository — find, insert and uid-scoped delete — asserting every binary field's v1 width before writing.
• Adds findPasskeyByUidAndCredentialId to the passkey repository, so an ownership check is one primary-key lookup returning the full record.
• Adds service store and get methods with ownership and idempotency checks, plus StatsD counters.
• Adds errnos 234–235 with AppError factories, and corrects the lib README's error-handling section.
• Runs testAccountDatabaseSetup fixture SQL sequentially rather than through Promise.all.

Issue that this pull request solves

Closes: FXA-13140

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Key files/areas to focus on: passkey.wrap.repository.ts and the wrap methods in passkey.service.ts.
• Suggested review order: kysely types → repository → service → tests.
• Risky or complex parts: the width assertions. MySQL right-pads BINARY rather than rejecting, so a wrong width is a permanently unopenable envelope.

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

• An earlier revision added a version column and patch 196→197. Dropped after review: the only changes it could discriminate are same-width AEAD or KDF swaps, which are both unlikely and survivable by retry, while a KEM change resizes the columns anyway and is self-describing.
• Dropping updatedAt is deferred to its own PR. The column is NOT NULL and now always equals createdAt, so it should go, but removing it touches a migration plus the type, factory, fixture and tests — out of scope here.
• No re-seal path. A kB change deletes wraps instead of updating them, so deleteAllPasskeyWrapsForUser is the only invalidation route; wiring it into password reset is follow-up work.
• Pairs with feat(settings): Add passkey HPKE key-wrapping crypto lib #21006 (FXA-13144), which builds the envelopes this stores.

[nshirley]

This was just clean up for documentation that was out of date. It was originally written with the first iteration of errors in the library, but we later pivoted and didn't update the README

[nshirley]

I could have used the golevelup createMock, but that would require adding that as a dev dependency at the root and I didn't want to do that here... but might be worth it. This just let's us do near the same thing and maintain strong typing on the tests

[vpomerleau]

What would be the advantage of switching to createMock? Easier maintenance?

[nshirley]

Exactly, yeah. The createMock from golevelup creates a partial mock of whatever type is given, so we don't have to do this Pick<Type, 'union' | 'properties'> pattern. It would just be createMock<PasskeyManager>({/** optional property overrides */}); and that's it. Code is cleaner and easier to manage.

I'll file something under the follow up epics. It doesn't need to happen, but will make it a bit less of a headache down the road.

[nshirley]

Snuck this in here since I wanted the integration tests for wraps, but the FK means the migrations must run in a specific order

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.

[vpomerleau]

This looks solid 💪 Just a few small comments/thoughts/questions

[vpomerleau]

Outdated PUT path mention; looks like we also have some PUT references to clean out from follow-up tickets too.

[vpomerleau]

Errors 236/237 are added but never used here - confirming these are needed and simply reserved for future tickets?

[nshirley]

They are planned to be used in a future ticket, but thanks for flagging. I'll remove them to keep the scope to just the lib work and the future ticket can implement them 🙂

[vpomerleau]

What would be the advantage of switching to createMock? Easier maintenance?