feat: Sprint 7 — Go SDK with QUIC transport and Cap'n Proto RPC

First non-Rust client SDK for quicproquo ecosystem.

- Cap'n Proto codegen: generated 6487-line Go types from node.capnp
  with all 24 RPC methods (NodeService, Auth, Envelope)
- QUIC transport: quic-go + TLS 1.3, ALPN "capnp", single bidi stream,
  300s idle timeout, InsecureSkipVerify for dev, custom CA cert support
- High-level qpq package: Connect, Health, ResolveUser, CreateChannel,
  Send/SendWithTTL, Receive/ReceiveWait, DeleteAccount, OPAQUE wrappers
- Auth management: session token storage, version/token/deviceID on all RPCs
- Example program and README with API reference

All tests pass: go test ./..., go vet, go build

sdks/go/proto/node/node.capnp

@@ -0,0 +1,45 @@
+# node.capnp — Go-annotated copy of the quicproquo node schema.
+# This adds Go package annotations needed by capnpc-go.
+@0xd5ca5648a9cc1c28;
+
+using Go = import "/go.capnp";
+$Go.package("node");
+$Go.import("quicproquo.dev/sdk/go/proto/node");
+
+interface NodeService {
+  uploadKeyPackage @0 (identityKey :Data, package :Data, auth :Auth) -> (fingerprint :Data);
+  fetchKeyPackage  @1 (identityKey :Data, auth :Auth) -> (package :Data);
+  enqueue @2 (recipientKey :Data, payload :Data, channelId :Data, version :UInt16, auth :Auth, ttlSecs :UInt32) -> (seq :UInt64, deliveryProof :Data);
+  fetch @3 (recipientKey :Data, channelId :Data, version :UInt16, auth :Auth, limit :UInt32) -> (payloads :List(Envelope));
+  fetchWait @4 (recipientKey :Data, channelId :Data, version :UInt16, timeoutMs :UInt64, auth :Auth, limit :UInt32) -> (payloads :List(Envelope));
+  health @5 () -> (status :Text);
+  uploadHybridKey @6 (identityKey :Data, hybridPublicKey :Data, auth :Auth) -> ();
+  fetchHybridKey  @7 (identityKey :Data, auth :Auth) -> (hybridPublicKey :Data);
+  opaqueRegisterStart  @8 (username :Text, request :Data) -> (response :Data);
+  opaqueRegisterFinish @9 (username :Text, upload :Data, identityKey :Data)  -> (success :Bool);
+  opaqueLoginStart  @10 (username :Text, request :Data)     -> (response :Data);
+  opaqueLoginFinish @11 (username :Text, finalization :Data, identityKey :Data) -> (sessionToken :Data);
+  publishEndpoint @12 (identityKey :Data, nodeAddr :Data, auth :Auth) -> ();
+  resolveEndpoint @13 (identityKey :Data, auth :Auth) -> (nodeAddr :Data);
+  peek @14 (recipientKey :Data, channelId :Data, version :UInt16, auth :Auth, limit :UInt32) -> (payloads :List(Envelope));
+  ack @15 (recipientKey :Data, channelId :Data, version :UInt16, seqUpTo :UInt64, auth :Auth) -> ();
+  fetchHybridKeys @16 (identityKeys :List(Data), auth :Auth) -> (keys :List(Data));
+  batchEnqueue @17 (recipientKeys :List(Data), payload :Data, channelId :Data, version :UInt16, auth :Auth, ttlSecs :UInt32) -> (seqs :List(UInt64));
+  createChannel @18 (peerKey :Data, auth :Auth) -> (channelId :Data, wasNew :Bool);
+  resolveUser @19 (username :Text, auth :Auth) -> (identityKey :Data, inclusionProof :Data);
+  resolveIdentity @20 (identityKey :Data, auth :Auth) -> (username :Text);
+  uploadBlob @21 (auth :Auth, blobHash :Data, chunk :Data, offset :UInt64, totalSize :UInt64, mimeType :Text) -> (blobId :Data);
+  downloadBlob @22 (auth :Auth, blobId :Data, offset :UInt64, length :UInt32) -> (chunk :Data, totalSize :UInt64, mimeType :Text);
+  deleteAccount @23 (auth :Auth) -> (success :Bool);
+}
+
+struct Auth {
+  version @0 :UInt16;
+  accessToken @1 :Data;
+  deviceId @2 :Data;
+}
+
+struct Envelope {
+  seq  @0 :UInt64;
+  data @1 :Data;
+}