DM channels (createChannel), channel authz, security/docs, future improvements

- Add createChannel RPC (node.capnp @18): create 1:1 channel, returns 16-byte channelId
- Store: create_channel(member_a, member_b), get_channel_members(channel_id)
- FileBackedStore: channels.bin; SqlStore: migration 003_channels, schema v4
- channel_ops: handle_create_channel (auth + identity, peerKey 32 bytes)
- Delivery authz: when channel_id.len() == 16, require caller and recipient are channel members (E022/E023)
- Error codes E022 CHANNEL_ACCESS_DENIED, E023 CHANNEL_NOT_FOUND
- SUMMARY: link Certificate lifecycle; security audit, future improvements, multi-agent plan docs
- Certificate lifecycle doc, SECURITY-AUDIT, FUTURE-IMPROVEMENTS, MULTI-AGENT-WORK-PLAN
- Client/core/tls/auth/server main: assorted fixes and updates from review and audit

Co-authored-by: Cursor <cursoragent@cursor.com>

crates/quicnprotochat-server/migrations/003_channels.sql

@@ -0,0 +1,13 @@
+-- Migration 003: 1:1 DM channels.
+-- channel_id is 16 bytes (UUID); member_a and member_b are identity keys in sorted order.
+-- Unique on (member_a, member_b) prevents duplicate channels between the same pair.
+
+CREATE TABLE IF NOT EXISTS channels (
+    channel_id BLOB PRIMARY KEY,
+    member_a   BLOB NOT NULL,
+    member_b   BLOB NOT NULL,
+    UNIQUE(member_a, member_b)
+);
+
+CREATE INDEX IF NOT EXISTS idx_channels_members
+    ON channels(member_a, member_b);