Add bounded read bundles and covering indexes

[Jason-Doyle]

Summary

• add opt-in bounded point-read bundles for eligible cold cache misses
• advertise the capability through authority configuration and retain automatic fallback to individual TDB1 object reads
• enforce explicit scope grants, four-object and 4 MiB response limits, and no-store HTTPS responses
• add explicit covering fields to declared indexes and schema-validated typed projections
• bound each covering projection to 64 KiB and every complete index page to 4 MiB before document objects are written
• document embedded and separately deployed authority topologies, same-origin requirements, and selection criteria

Security and compatibility

Read bundles are disabled unless readBundles: true or THIMBLE_READ_BUNDLES=true is configured. The trusted authority decrypts the bounded cache values and sends them over HTTPS. Deployments that require every read response above TLS to remain a TDB1 envelope can leave the capability disabled.

Older authorities omit the capability, older clients ignore it, and current clients fall back for absent, legacy, or oversized bundles. Covering-index fields are optional index-page extensions. Upgrade all writing authorities and rebuild an index before enabling or changing its covering fields.

Validation

• TypeScript and Studio type checks
• 205 unit tests
• nine Chromium, Firefox, and WebKit application and Studio tests
• one-request cold bundle and bounded fallback tests
• aggregate and per-projection index bounds before content writes
• package and generated-scaffold verification
• Node and Cloudflare starter builds against the packed 3.1.0 artifact
• site build, worker tests, browser tests, and Cloudflare deployment dry run
• examples and comparative harness
• dependency audits and GitHub Actions workflow lint
• generic and AWS container builds
• 15 Mermaid diagrams rendered