DM channels (createChannel), channel authz, security/docs, future improvements

- Add createChannel RPC (node.capnp @18): create 1:1 channel, returns 16-byte channelId
- Store: create_channel(member_a, member_b), get_channel_members(channel_id)
- FileBackedStore: channels.bin; SqlStore: migration 003_channels, schema v4
- channel_ops: handle_create_channel (auth + identity, peerKey 32 bytes)
- Delivery authz: when channel_id.len() == 16, require caller and recipient are channel members (E022/E023)
- Error codes E022 CHANNEL_ACCESS_DENIED, E023 CHANNEL_NOT_FOUND
- SUMMARY: link Certificate lifecycle; security audit, future improvements, multi-agent plan docs
- Certificate lifecycle doc, SECURITY-AUDIT, FUTURE-IMPROVEMENTS, MULTI-AGENT-WORK-PLAN
- Client/core/tls/auth/server main: assorted fixes and updates from review and audit

Co-authored-by: Cursor <cursoragent@cursor.com>

crates/quicnprotochat-client/Cargo.toml

@@ -38,6 +38,7 @@ thiserror     = { workspace = true }
 sha2          = { workspace = true }
 argon2        = { workspace = true }
 chacha20poly1305 = { workspace = true }
+zeroize       = { workspace = true }
 quinn         = { workspace = true }
 quinn-proto   = { workspace = true }
 rustls        = { workspace = true }
@@ -49,10 +50,12 @@ tracing-subscriber = { workspace = true }
 # CLI
 clap          = { workspace = true }
 
+# Hex encoding/decoding
+hex           = "0.4"
+
 [dev-dependencies]
 dashmap       = { workspace = true }
 assert_cmd    = "2"
 tempfile      = "3"
 portpicker    = "0.1"
 rand          = "0.8"
-hex           = "0.4"