Capability: crypto-browser-engine

ADDED Requirements

REQ-BRW-001: Package name @suaveplan/crypto-browser, packages/universal/crypto-browser.
REQ-BRW-002: Runtime deps: @suaveplan/crypto, @suaveplan/error, tslib. Zero Node-only deps.
REQ-BRW-003: All exports are async (return Promise<...>) — crypto.subtle is async.

REQ-BRW-010: Exports webCryptoAeadEngine: AeadEngine — AES-256-GCM via crypto.subtle.encrypt/decrypt (hardware-accelerated in supporting browsers/runtimes).
REQ-BRW-011: Exports webCryptoSignEngine: SignEngine — Ed25519 and ECDSA-P256 via crypto.subtle.
REQ-BRW-012: Exports webCryptoAgreeEngine: AgreeEngine — X25519 and ECDH-P256 via crypto.subtle.

REQ-BRW-020: Exports rsa namespace: { generateKeypair(algorithm, modulusLength?), sign(algorithm, privateKey, message), verify(algorithm, publicKey, signature, message), encrypt(publicKey, plaintext), decrypt(privateKey, ciphertext) }. Algorithms: "RSA-PSS", "RSA-OAEP", "RSASSA-PKCS1-v1_5".
REQ-BRW-021: Exports aesKw namespace: { wrapKey(wrappingKey, keyToWrap), unwrapKey(wrappingKey, wrappedKey) }.
REQ-BRW-022: Exports ecdsaP384 namespace: sign/verify/generateKeypair on P-384 curve.
REQ-BRW-023: Exports ecdhP384 namespace: agree/generateKeypair on P-384 curve.
REQ-BRW-024: Exports nonExtractableKey(algorithm, usages): Promise<CryptoKey> — generates a non-extractable CryptoKey handle. Key material is never accessible to JS code after generation.

REQ-BRW-030: Exports isWebCryptoAvailable(): boolean — returns typeof crypto !== 'undefined' && !!crypto.subtle.
REQ-BRW-031: All operations throw BrowserCryptoError("BROWSER_CRYPTO.NOT_AVAILABLE") if called in an environment without crypto.subtle.

REQ-BRW-040: Exports BrowserCryptoError extends SuaveplanError<BrowserCryptoCode>.
REQ-BRW-041: Codes: BROWSER_CRYPTO.NOT_AVAILABLE, BROWSER_CRYPTO.KEY.GENERATION_FAILED, BROWSER_CRYPTO.OPERATION.FAILED.