[sub-spm-optional-products] Add LCECryptoKit and LCFeatureControl as optional sub-SPM products

LCEssentials installs standalone; each sub target-depends on it so linking a
sub's product always pulls LCEssentials in too, without the consumer having to
declare it separately.

- LCECryptoKit: internalized from the remote LCECryptoKitBinary git dependency
  (embedded token URL removed) into a local binaryTarget vendoring
  Frameworks/LCECryptoKit.xcframework. LCECryptoKitManager moved out of
  LCEssentials core into its own LCECryptoKitManager target/product; the
  no-op fallback for when the binary wasn't linked is gone (breaking change
  for existing consumers, see decisions/2026-09-15-sub-spm-optional-products.md).
- LCFeatureControl: new product wrapping Atomenta's Feature Control API
  (flag evaluation with TTL cache + safe-degrade fallback to defaults,
  notifications inbox, batched exposure telemetry). 45 new tests.

Sources/LCECryptoKitManager/LCECryptoKitManager.swift

@@ -0,0 +1,81 @@
+//
+// Copyright (c) 2025 Loverde Co.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+import Foundation
+import LCEssentials
+import LCECryptoKit
+
+public final class LCECryptoKitManager {
+
+    private let hashKey: String
+
+    public init() {
+        self.hashKey = ""
+    }
+
+    public init(privateKey: String) {
+        self.hashKey = privateKey
+    }
+
+    public static func generateKey() -> String {
+        LCECryptoKit.generateRandomAESKeyString()
+    }
+
+    public func encodeTP(email: String, password: String) -> String? {
+        return LCECryptoKit.encodeSeed(email: email, password: password)
+    }
+
+    public func decodeOTP(_ otpHash: String) -> String? {
+        return LCECryptoKit.decodeSeed(otpKey: otpHash)
+    }
+
+    // MARK: Need hashKey to decode
+
+    public func encodeOTPWithKey(email: String, password: String) -> String? {
+        return LCECryptoKit.encodeSeed(email: email, password: password, hashKey: self.hashKey)
+    }
+
+    public func decodeOTPWithKey(_ otpHash: String) -> Bool {
+        LCECryptoKit.decodeSeed(otpKey: otpHash, hashKey: self.hashKey)
+    }
+
+    // MARK: - Salted/Iterated/Peppered Login (atomenta-cryptokit-pepper-refactor-sdd.md)
+
+    public static func generateSalt() -> String {
+        LCECryptoKit.generateSalt()
+    }
+
+    public static func computeClientHash(email: String, password: String, salt: String) -> String {
+        LCECryptoKit.computeClientHash(email: email, password: password, salt: salt)
+    }
+
+    public static func computeLoginBearerToken(userId: String, clientHash: String) -> String? {
+        LCECryptoKit.computeLoginBearerToken(userId: userId, clientHash: clientHash)
+    }
+
+    public static func otpEncode(_ plainText: String) -> String? {
+        LCECryptoKit.otpEncode(plainText)
+    }
+
+    public static func otpDecode(_ otpEncoded: String) -> String? {
+        LCECryptoKit.otpDecode(otpEncoded)
+    }
+}