DM channels (createChannel), channel authz, security/docs, future improvements

- Add createChannel RPC (node.capnp @18): create 1:1 channel, returns 16-byte channelId
- Store: create_channel(member_a, member_b), get_channel_members(channel_id)
- FileBackedStore: channels.bin; SqlStore: migration 003_channels, schema v4
- channel_ops: handle_create_channel (auth + identity, peerKey 32 bytes)
- Delivery authz: when channel_id.len() == 16, require caller and recipient are channel members (E022/E023)
- Error codes E022 CHANNEL_ACCESS_DENIED, E023 CHANNEL_NOT_FOUND
- SUMMARY: link Certificate lifecycle; security audit, future improvements, multi-agent plan docs
- Certificate lifecycle doc, SECURITY-AUDIT, FUTURE-IMPROVEMENTS, MULTI-AGENT-WORK-PLAN
- Client/core/tls/auth/server main: assorted fixes and updates from review and audit

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/src/architecture/crate-responsibilities.md

@@ -1,9 +1,11 @@
 # Crate Responsibilities
 
-The quicnprotochat workspace is split into four crates with strict layering
-rules. Each crate owns one concern and depends only on the crates below it.
-This page documents what each crate provides, what it explicitly avoids, and
-how the crates relate to one another.
+The quicnprotochat workspace contains six crates. The main four (proto, core,
+server, client) follow strict layering rules; each owns one concern and depends
+only on the crates below it. The workspace also includes **quicnprotochat-gui**
+(Tauri desktop app) and **quicnprotochat-p2p** (P2P endpoint resolution). This
+page documents what each crate provides, what it explicitly avoids, and how the
+crates relate to one another.
 
 ---
 
@@ -198,6 +200,17 @@ group state to disk.
 
 ---
 
+## Other workspace crates
+
+| Crate                   | Role |
+|-------------------------|------|
+| **quicnprotochat-gui**  | Tauri 2 desktop application; provides a GUI on top of the client/core stack. |
+| **quicnprotochat-p2p**  | P2P endpoint publish/resolve; used by the server and clients for direct peer discovery. |
+
+These crates are optional for building and running the server and CLI client.
+
+---
+
 ## Layering Rules
 
 1. **proto** depends on nothing in-workspace. It is pure data definition.
@@ -207,6 +220,8 @@ group state to disk.
 4. **client** depends on **core** and **proto**. It does not depend on server.
 5. **server** and **client** never depend on each other. They communicate
    exclusively via the Cap'n Proto RPC wire protocol.
+6. **quicnprotochat-gui** and **quicnprotochat-p2p** are optional; they depend
+   on client/core/proto as needed and do not change the core layering.
 
 This layering ensures that: