agent-bridge spike S2: end-to-end encryption interop

Noise_XX_P256_AESGCM_SHA256 on this browser's WebCrypto, checked byte for byte against a transcript produced by the .NET implementation. Nothing is sent anywhere unless this page is served by the spike's own server (live checks).