diigo-cache: bookmark cache in Durable Objects (goal 1c)

The dump worker becomes a page cache: a hit is served from DO SQLite
storage with no diigo call; a miss asks the webapp instance in the
cache's wiring and etches the page.

- two independent caches, one behavior (PagedCache): DiigoCache keeps
  every item; PublicCache keeps shared items only, dropping private
  rows before they are stored; served at /public/<username> (HTML page
  form, or JSON)
- create flow on one port: /_connect relays webapp's mint form, /_mint
  proxies the mint, /_wire wires a private or public cache; /_publish
  adds a public cache later
- ids are webkeys: kept out of URLs (POST bodies), shown and logged
  only as a hash fingerprint; saved to the password manager under the
  holder's petname (never sent to the server)
- items keyed on diigo's link_id; username from u_name; unkeyable
  items and every failure path are logged; each page read logs hit/miss
- tests run the real worker + DOs in the vitest pool against a fake
  webapp (tests/fake-webapp.js)

Generated-by: opencode (GLM)
Generated-by: Claude Opus 5.5

diigo-cache/wrangler.jsonc

@@ -1,6 +1,6 @@
 {
 	"$schema": "node_modules/wrangler/config-schema.json",
-	"name": "diigo-dump",
+	"name": "diigo-cache",
 	"main": "src/index.ts",
 	"compatibility_date": "2026-09-29",
 	"observability": { "enabled": true },
@@ -10,5 +10,15 @@
 			"service": "webapp",
 			"entrypoint": "WebAppFactory"
 		}
-	]
+	],
+	"durable_objects": {
+		"bindings": [
+			{ "name": "CACHE_DO", "class_name": "DiigoCache" },
+			{ "name": "PUBLIC_DO", "class_name": "PublicCache" }
+		]
+	},
+	"exports": {
+		"DiigoCache": { "type": "durable-object", "storage": "sqlite" },
+		"PublicCache": { "type": "durable-object", "storage": "sqlite" }
+	}
 }