[sub-spm-optional-products] Add LCECryptoKit and LCFeatureControl as optional sub-SPM products

LCEssentials installs standalone; each sub target-depends on it so linking a
sub's product always pulls LCEssentials in too, without the consumer having to
declare it separately.

- LCECryptoKit: internalized from the remote LCECryptoKitBinary git dependency
  (embedded token URL removed) into a local binaryTarget vendoring
  Frameworks/LCECryptoKit.xcframework. LCECryptoKitManager moved out of
  LCEssentials core into its own LCECryptoKitManager target/product; the
  no-op fallback for when the binary wasn't linked is gone (breaking change
  for existing consumers, see decisions/2026-09-15-sub-spm-optional-products.md).
- LCFeatureControl: new product wrapping Atomenta's Feature Control API
  (flag evaluation with TTL cache + safe-degrade fallback to defaults,
  notifications inbox, batched exposure telemetry). 45 new tests.

Documentation/Extensions.md

@@ -1760,12 +1760,24 @@ digest.map { String(format: "%02x", $0) }.joined()
 </details>
 
 <details>
-<summary><b>LCECryptoKitManager</b> — OTP / peppered-login bridge (needs the <code>LCECryptoKit</code> binary)</summary>
+<summary><b>LCECryptoKitManager</b> — OTP / peppered-login bridge (separate <code>LCECryptoKit</code> product)</summary>
 
-A thin facade over the optional `LCECryptoKit` binary product (enabled by the
-`LCE_ENABLE_CRYPTO_BINARY` build flag). **When the binary is not linked every
-method is a no-op** returning `nil` / `""` / `false`, so calling code still
-compiles and runs.
+Lives in its own SPM product, `LCECryptoKit` (target `LCECryptoKitManager`), not in
+`LCEssentials` itself — an optional sub-package that target-depends on `LCEssentials`.
+Add it explicitly alongside `LCEssentials` to a consumer's `Package.swift`:
+
+```swift
+.product(name: "LCEssentials", package: "LCEssentials"),
+.product(name: "LCECryptoKit", package: "LCEssentials"),
+```
+
+```swift
+import LCECryptoKitManager
+```
+
+Wraps the vendored `LCECryptoKit.xcframework` (iOS device + simulator only — no
+macOS/tvOS/watchOS slices). Consumers who don't link this product simply don't get
+the symbol; there is no no-op fallback anymore.
 
 ### `init()` / `init(privateKey:)`