Green: unseal shared collection keys with the account keypair

decryptCollection now takes the full key material {masterKey,
publicKey, secretKey} and dispatches on keyDecryptionNonce: present
means an owned collection (secretbox under the master key), absent
means a shared collection (sealed box to our public key). Client
already held the keypair for unsealing the auth token, so it just
passes it through.

src/client.ts

@@ -156,7 +156,15 @@ export class Client {
             collections: RawCollection[];
         }>("/collections/v2", { sinceTime: 0 });
         return collections.map((raw) =>
-            decryptCollection(raw, this.masterKey, this.userID),
+            decryptCollection(
+                raw,
+                {
+                    masterKey: this.masterKey,
+                    publicKey: this.publicKey,
+                    secretKey: this.secretKey,
+                },
+                this.userID,
+            ),
         );
     }