capsite/lib: MapStore and patterns work-alikes

Enough of @agoric/store's MapStore and @endo/patterns' M for the
credential-rotation design: makeMapStore(label, { keyShape, valueShape },
kv) keeps entries in a DO's sync KV under store:<label>:, and readOnly()
hands out the queries alone. Facets are workerd RpcTargets in place of
endo's Far.

Unlike endo, error messages never include keys or values: the values
here are credentials, and messages cross RPC into logs.

Generated-by: Claude Opus 5.5

lib/wrangler.tests.jsonc

@@ -0,0 +1,13 @@
+{
+	"$schema": "node_modules/wrangler/config-schema.json",
+	// a host DO for the stores under test (lib ships no worker of its own)
+	"name": "capsite-lib-tests",
+	"main": "./tests/test-worker.ts",
+	"compatibility_date": "2026-09-29",
+	"durable_objects": {
+		"bindings": [{ "name": "STORE_DO", "class_name": "StoreHost" }]
+	},
+	"exports": {
+		"StoreHost": { "type": "durable-object", "storage": "sqlite" }
+	}
+}