feat: add protocol comparison docs, P2P crate, production audit, and design fixes

Add comprehensive documentation comparing quicnprotochat against classical
chat protocols (IRC+SSL, XMPP, Telegram) with diagrams and attack scenarios.
Promote comparison pages to top-level sidebar section. Include P2P transport
crate (iroh), production readiness audit, CI workflows, dependency policy,
and continued architecture improvements across all crates.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

schemas/node.capnp

@@ -9,8 +9,7 @@ interface NodeService {
   # Upload a single-use KeyPackage for later retrieval by peers.
   # identityKey : Ed25519 public key bytes (32 bytes)
   # package     : TLS-encoded openmls KeyPackage
-  # auth        : Auth context (versioned). For legacy clients, pass an empty
-  #               struct or version=0.
+  # auth        : Auth context (version=1, non-empty accessToken required).
   uploadKeyPackage @0 (identityKey :Data, package :Data, auth :Auth) -> (fingerprint :Data);
 
   # Fetch and atomically remove one KeyPackage for a given identity key.
@@ -18,9 +17,9 @@ interface NodeService {
   fetchKeyPackage  @1 (identityKey :Data, auth :Auth) -> (package :Data);
 
   # Enqueue an opaque payload for delivery to a recipient.
-  # channelId : Optional channel identifier (empty for legacy). A 16-byte UUID
+  # channelId : Optional channel identifier (empty for default). A 16-byte UUID
   #             is recommended for 1:1 channels.
-  # version   : Schema/wire version. Must be 0 (legacy) or 1 (this spec).
+  # version   : Schema/wire version. Must be 1.
   enqueue @2 (recipientKey :Data, payload :Data, channelId :Data, version :UInt16, auth :Auth) -> ();
 
   # Fetch and drain all queued payloads for the recipient.
@@ -67,7 +66,7 @@ interface NodeService {
 }
 
 struct Auth {
-  version @0 :UInt16;   # 0 = legacy/none, 1 = token-based auth
+  version @0 :UInt16;   # 1 = token-based auth (required)
   accessToken @1 :Data; # opaque bearer token issued at login
   deviceId @2 :Data;    # optional UUID bytes for auditing/rate limiting
 }