Add bounded structured crypto operations

docs/setup.md

@@ -745,6 +745,20 @@ if(valid && password_needs_rehash(encoded))
 
 `password_hash()` returns a self-contained `$uce$scrypt$...` encoding with a random 16-byte salt and the bounded scrypt parameters `N=65536`, `r=8`, `p=1`. `password_verify()` accepts only structurally valid encodings with bounded cost parameters and compares the derived key in constant time. `password_needs_rehash()` reports malformed, legacy, or non-current parameters so applications can upgrade a credential after a successful legacy verification. Treat an empty hash as an operational failure and never store it. Application-level password length policy, rate limiting, and legacy-format verification remain the application's responsibility.
 
+## Structured cryptographic operations
+
+`crypto_operation(request)` is the bounded, algorithm-selected API for structured
+asymmetric operations. The initial allowlist supports `operation=key_generate`
+and `operation=jwt_sign` with `algorithm=ES256`. Key generation returns P-256
+public/private JWKs plus the RFC 7638 thumbprint (`kid`). JWT signing accepts only
+a consistent P-256 private JWK, forces `alg=ES256`, and emits a compact JWT with
+a 64-byte JOSE signature. Unknown operations and algorithms fail closed.
+
+Existing typed digest, HMAC, password, randomness, and constant-time comparison
+functions remain separate. `crypto_operation()` exposes no raw signing, arbitrary
+digest/curve selection, encryption, network fetch, or token exchange. Store
+private JWKs as secrets.
+
 ## Operational footguns
 
 - Keep the FastCGI socket path consistent: `FCGI_SOCKET_PATH` and the web-server `fastcgi_pass` must match exactly. The reference config uses `/run/uce/fastcgi.sock`; if you choose `/run/uce.sock`, use it in both places.