TS port slice 7: entry modify/archive/links + util generate-password

- core entryMod: modify_entry port with the per-kind allowed-field matrix,
  policy merging, blacklisted-field cleanup and timestamp touching;
  archive/restore; typed links (add/remove/get with Python's normalization,
  dedupe on target/relation/note, self-link and missing-target refusal).
- Parity fixture entry_mods.json: the real Python EntryManager applies a
  10-op modification sequence at a later pinned clock; TS replays the same
  ops from the creation state and matches byte-for-byte.
- CLI: entry modify/archive/unarchive/links/link-add/link-remove,
  entry totp-codes (explicit egress, honors --at and archived state),
  util generate-password (Python parity: index 0 + gen v1 defaults, full
  policy flags — v1/v2 outputs verified against password fixtures).
- capabilities: egress command list updated.
- 148 core parity tests (Node + jsdom) + 22 CLI tests green.

Co-Authored-By: Claude Fable 5 <[email protected]>

js/packages/cli/src/capabilities.ts

@@ -18,14 +18,18 @@ export function capabilities(): Record<string, unknown> {
     agent_surface: {
       reference_scheme: "sp://entry/<id>",
       reference_first_output: true,
-      plaintext_egress_commands: ["entry reveal"],
+      plaintext_egress_commands: [
+        "entry reveal",
+        "entry totp-codes",
+        "util generate-password",
+      ],
       sinks: ["clipboard", "exec-env", "stdin-to"],
       exec_env_var: "SEEDPASS_SECRET",
     },
     not_yet_ported: [
       "ssh/pgp key material",
       "relay sync commands",
-      "profile management",
+      "profile and config management",
       "index0/atlas",
       "leases and scoped tokens (design: plan section 9.3)",
     ],