Function hkdf

hkdf(
    ikm: Uint8Array,
    salt: Uint8Array,
    info: Uint8Array,
    length: number,
): Promise<Uint8Array>
HKDF-SHA256 per RFC 5869, implemented with the native WebCrypto HKDF primitive (NOT the PBKDF2-based workaround used in some libraries).

Domain separation: all info strings in Me2eM start with me2em/crypto/v1/… — callers MUST use a unique info per purpose.
Parameters
- ikm: Uint8Array
  Input key material (high entropy: derived from seed or another key, NOT a human password — for passwords use a password KDF like Argon2id, planned separately).
- salt: Uint8Array
  Random or context salt; may be empty. Fresh salt per derivation is recommended when deriving session-scoped keys.
- info: Uint8Array
  Purpose/context string.
- length: number
  Output bytes (max 255*32 = 8160).
Returns Promise<Uint8Array>
The derived key material of the requested length.
Throws
'KDF/DERIVATION_FAILED' if WebCrypto fails, or length > 8160.
Example
```
const cacheKey = await hkdf(loginMaterial, freshSalt,
  'me2em/crypto/v1/cache-wrap', 32);
```
- Defined in packages/crypto/src/core/hkdf.ts:45