feat: Sprint 8 — TypeScript SDK with WASM crypto and browser demo

- WASM crypto bundle (175KB): 13 wasm_bindgen functions wrapping
  quicproquo-core's Ed25519 identity, X25519+ML-KEM-768 hybrid KEM,
  safety numbers, sealed sender, and message padding
- @quicproquo/client TypeScript SDK: QpqClient class with connect,
  health, resolveUser, createChannel, send/sendWithTTL, receive,
  deleteAccount; WebSocket transport with request/response correlation
  and reconnection; ergonomic crypto.ts wrapper over WASM functions
- Browser demo: vanilla HTML page with interactive crypto operations
  (identity gen, safety numbers, sign/verify, hybrid encrypt/decrypt,
  sealed sender, padding) and chat UI for server connectivity
- Offline mode: crypto operations work without server connection

TypeScript strict mode, 0 errors. WASM bundle size optimized (lto + opt-level=s).

sdks/typescript/README.md

@@ -0,0 +1,68 @@
+# @quicproquo/client
+
+TypeScript SDK for [quicproquo](https://github.com/nicholasgasior/quicproquo) --
+an E2E encrypted group messenger built on MLS (RFC 9420), hybrid post-quantum
+key exchange (X25519 + ML-KEM-768), and sealed sender envelopes.
+
+## Features
+
+- **WASM-powered crypto** -- Ed25519 signatures, hybrid KEM, sealed sender,
+  message padding, safety numbers -- all compiled from the Rust `quicproquo-core`
+  crate via `wasm-pack`.
+- **High-level client API** -- `QpqClient` wraps transport + crypto into a
+  type-safe interface for resolving users, creating channels, and exchanging
+  messages.
+- **Offline mode** -- All crypto operations work without a server connection.
+  Use `QpqClient.offline()` for key generation, signing, encryption, etc.
+- **Transport abstraction** -- Pluggable `Transport` interface with a built-in
+  `WebSocketTransport` for browser environments.
+
+## Quick start
+
+```typescript
+import { QpqClient } from "@quicproquo/client";
+
+// Crypto-only (no server needed)
+const client = await QpqClient.offline();
+const alice = client.generateIdentity();
+const bob = client.generateIdentity();
+const safetyNumber = client.computeSafetyNumber(alice.publicKey, bob.publicKey);
+console.log("Safety number:", safetyNumber);
+
+// Sign and verify
+const msg = new TextEncoder().encode("hello");
+const sig = client.sign(alice.seed, msg);
+console.log("Valid:", client.verify(alice.publicKey, msg, sig));
+```
+
+## Server connection
+
+The native qpq server speaks Cap'n Proto RPC over QUIC/TCP with Noise_XX.
+Browsers cannot open raw TCP sockets, so a WebSocket bridge proxy is required
+for full server connectivity:
+
+```typescript
+const client = await QpqClient.connect({ addr: "wss://bridge.example.com" });
+const peerKey = await client.resolveUser("bob");
+const channel = await client.createChannel(peerKey);
+```
+
+## Building
+
+```bash
+npm install
+npm run build    # compiles to dist/
+```
+
+## Project structure
+
+```
+src/
+  index.ts       -- public API exports
+  client.ts      -- QpqClient class (high-level API)
+  transport.ts   -- Transport interface + WebSocket implementation
+  crypto.ts      -- WASM crypto wrapper
+  types.ts       -- TypeScript type definitions
+pkg/             -- WASM output (built by wasm-pack)
+demo/            -- Browser demo page
+```