feat(client): behavioral human-likelihood for clearance mints (#328)

[cport1]

SDK half of WebDecoy/app#328 (PRD FR10) — pairs with WebDecoy/app#354.

A session that a human actually interacts with can now present positive evidence of it and upgrade its wd_clearance token to the graded human-likely trust level that routes can require.

Flow

Mint clean at idle exactly as before, then watch passively. Once there has been real interaction, summarize it once, re-mint with the aggregates attached, and stop listening. A session that never interacts sends nothing. One upgrade per page load, no matter how many times clearance is started or refreshed.

What leaves the browser

Counts, durations, variances and ratios — and nothing else.

Never: pointer coordinates, key identities, form values, DOM or page content, URLs, or any replayable event stream. The aggregates describe how a session moved, never what it did — the whole difference between this and a session-replay product. A test asserts the exact field list, so the payload cannot grow without a deliberate change to the published contract.

Reuses the existing BehavioralCollector rather than a parallel implementation; summarizeBehavior() maps it to the wire shape and drops everything else.

Details worth a second look

• The 24-sample floor sits above the collector's own 20-sample threshold on purpose. Below 20, _detectMicroTremor returns a 0.5 placeholder rather than a measurement — and the server reads 0.5 as genuine human tremor. Shipping it would manufacture human evidence out of a mouse twitch.
• The 750ms window floor also refuses tight scripted bursts client-side, so what reaches the server is the harder scripted case: automation that paces itself. (One test vector had to be rewritten for exactly this reason — the tight-loop version was correctly refused before it could be compared.)
• The device fingerprint — the only expensive step, one canvas + one WebGL read — is computed inside the upgrade callback, so a session that never interacts never pays for it.
• Listeners are passive (never delay scroll or input) and removed on delivery: zero steady-state cost for a cleared session.
• A failed upgrade leaves the existing clean token untouched.
• startClearance({ behavior: false }) opts out entirely; tokens then stay at clean.

Accessibility

A keyboard-only session produces no pointer cadence and is unscored, not scored badly — summarizeBehavior returns null rather than a low number, so the mint stays clean instead of looking bot-like. Covered by an explicit test.

Verification

10 new tests, 20/20 green in @webdecoy/client; turbo build clean including the DTS build.