Finish ZeroKMS vs HSM comparison + add comparison diagrams

[coderdan]

Follow-up to #31, which migrated the ZeroKMS comparison content from cipherstash-js-suite PR #364. Some of it landed as work-in-progress and needs finishing.

1. Fill in the WIP TODOs in zerokms-vs-hsm.mdx

content/stack/reference/comparisons/zerokms-vs-hsm.mdx still carries the original draft's TODO markers:

• Benefits of HSM section — currently just TODO
• Operational complexity — TODO: key ceremonies, replication, uptime (eg. power), reliability etc
• Compliance section — TODO: Talk about PCI/DSS etc
• Physical access "ZeroKMS Advantage" callout — TODO: this could be worded better
• Cryptographic custody / distributed trust link — TODO (may warrant its own "Trust Model" article)

2. Replace the diagram placeholder

The "Hybrid solutions" section of zerokms-vs-hsm.mdx originally used a D2 diagram, but this repo has no D2 renderer. It was converted to a {/* TODO */} comment with the original D2 source preserved inline:

• zerokms-vs-hsm.mdx — "Hybrid solutions" client/SDK/HSM diagram

Needs a decision on how diagrams are rendered in this repo (image export, mermaid support, or a diagram component).

Note: the original ZeroKMS vs Cloud KMS page also had a placeholder diagram, but that page was merged into aws-kms.mdx and the placeholder diagram (which was sample content) was dropped.

---

Once both are addressed, cipherstash-js-suite PR #364 can be closed.

[coderdan]

Two performance-claim follow-ups surfaced while rewriting the comparison pages for an agent-research audience (#31):

• Source the "14× faster than AWS KMS" throughput claim. It's currently unsourced (flagged with an inline {/* TODO */} in aws-kms.mdx). The FHE page cites an open-source benchmark harness; this figure should too, with conditions. The sub-5ms latency claim is now linked to the Artillery benchmark.
• Reconcile 14× vs 100× across the docs. Standardized on 14× in the comparison pages, but cipherstash/kms/index.mdx and reference/what-is-cipherstash.mdx still say 100×. A reader cross-referencing pages will hit the contradiction — pick one repo-wide once the benchmark is confirmed.