feat: add secure portable local and hosted transfer archives

[Ankit6149]

Closes #69.

Product outcome

This PR establishes an explicit, versioned, integrity-protected transfer path between browser-local, self-hosted, and future hosted SignalFlow deployments without implementing or pretending cloud sync exists.

Portable archive contract

• Adds .signalflow.json schema version 1 with a manifest, deployment metadata, campaigns, assets, blobs, source artifacts, approvals, exports, exclusions, and integrity metadata.
• Uses SHA-256 integrity and supports optional HMAC-SHA-256 signing/verification.
• Excludes provider keys, OAuth/session secrets, private endpoints, signed/private references, and local filesystem paths with an explicit exclusion report.
• Validates future schema, archive size, traversal-safe blob paths, payload lengths, integrity, signatures, and missing asset payloads.

Import workflow

• Adds dry-run preview with destination selection, counts, estimated asset bytes, warnings, exclusions, and conflict inventory.
• Supports skip, copy, and replace conflict policies.
• Preserves historical timestamps, generation runs, source snapshots, generated baselines, authoritative drafts, approvals, archives, source artifacts, exports, assets, and blobs.
• Records transfer provenance without relabeling imported content as newly generated.
• Adds idempotent re-import detection.
• Adds atomic rollback, non-atomic partial reports, resume, cancellation, and manual rollback journals.
• Uses the same application ports for memory, browser-local, and injected store-backed adapters.

Current truth

The browser UI will provide explicit local archive export/import. The same contract is ready for a hosted adapter, but this PR does not add cloud accounts, a database, object storage service, background upload jobs, or silent synchronization.

Verification in progress

The draft PR runs adversarial archive tests, local→store-backed→local round trips, duplicate/copy/replace handling, partial resume, rollback, legacy migration, metadata adapter contracts, dependency audit, and production build. UI, capability, and documentation integration will be added before the PR leaves draft.

[vercel]

Deployment failed with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/ankit6149s-projects?upgradeToPro=build-rate-limit