diigo-cache: bookmark cache in Durable Objects (goal 1c)

The dump worker becomes a page cache: a hit is served from DO SQLite
storage with no diigo call; a miss asks the webapp instance in the
cache's wiring and etches the page.

- two independent caches, one behavior (PagedCache): DiigoCache keeps
  every item; PublicCache keeps shared items only, dropping private
  rows before they are stored; served at /public/<username> (HTML page
  form, or JSON)
- create flow on one port: /_connect relays webapp's mint form, /_mint
  proxies the mint, /_wire wires a private or public cache; /_publish
  adds a public cache later
- ids are webkeys: kept out of URLs (POST bodies), shown and logged
  only as a hash fingerprint; saved to the password manager under the
  holder's petname (never sent to the server)
- items keyed on diigo's link_id; username from u_name; unkeyable
  items and every failure path are logged; each page read logs hit/miss
- tests run the real worker + DOs in the vitest pool against a fake
  webapp (tests/fake-webapp.js)

Generated-by: opencode (GLM)
Generated-by: Claude Opus 5.5

diigo-cache/package.json

@@ -1,9 +1,11 @@
 {
-	"name": "diigo-dump",
+	"name": "diigo-cache",
 	"private": true,
+	"type": "module",
 	"scripts": {
 		"dev": "wrangler dev -c wrangler.jsonc -c ../webapp/wrangler.jsonc",
-		"diigo-login": "scripts/diigo-login"
+		"test": "vitest run",
+		"typecheck": "tsc -p tsconfig.check.json"
 	},
 	"devDependencies": {
 		"wrangler": "^4.148.0"