Optional IPFS backend for project-store (encrypted cross-device sync, no server)

[criptogus]

A concrete, CRDT-free first step toward Phase 3 of the roadmap (local-first collaboration).

Proposal

packages/project-store is a local JSONL store that already mirrors a cloud project model. Add an optional, encrypted IPFS backend behind it:

• Documents and project metadata are encrypted client-side (user-held key) and pinned to IPFS (configurable pinning service or self-hosted node); the store keeps CID pointers.
• A second machine with the same key pulls and decrypts — cross-device sync and backup with no central server and no account.
• Strictly opt-in and layered: the filesystem remains the source of truth; disabling the backend loses nothing.

Why before CRDT

Real-time co-editing (Phase 3) needs a transport and identity layer anyway. Single-writer encrypted sync delivers most of the day-one user value (my documents on all my machines, survivable backups) at a fraction of the complexity, and the key/CID plumbing it creates is reusable by the later collaboration work.

Open questions (please discuss before implementing)

• Pinning strategy: bring-your-own pinning service vs bundling a default (cost/abuse trade-offs).
• Key management UX: passphrase-derived vs generated key file; recovery story.
• Conflict policy for the single-writer model (last-writer-wins with visible history?).

Part of the "off SaaS" track.