chore: rename project quicnprotochat -> quicproquo (binaries: qpq)

Rename the entire workspace:
- Crate packages: quicnprotochat-{core,proto,server,client,gui,p2p,mobile} -> quicproquo-*
- Binary names: quicnprotochat -> qpq, quicnprotochat-server -> qpq-server,
  quicnprotochat-gui -> qpq-gui
- Default files: *-state.bin -> qpq-state.bin, *-server.toml -> qpq-server.toml,
  *.db -> qpq.db
- Environment variable prefix: QUICNPROTOCHAT_* -> QPQ_*
- App identifier: chat.quicnproto.gui -> chat.quicproquo.gui
- Proto package: quicnprotochat.bench -> quicproquo.bench
- All documentation, Docker, CI, and script references updated

HKDF domain-separation strings and P2P ALPN remain unchanged for
backward compatibility with existing encrypted state and wire protocol.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

crates/quicproquo-proto/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name        = "quicproquo-proto"
+version     = "0.1.0"
+edition     = "2021"
+description = "Cap'n Proto schemas, generated types, and serialisation helpers for quicproquo. No crypto, no I/O."
+license     = "MIT"
+
+# build.rs invokes capnpc to generate Rust source from .capnp schemas.
+build       = "build.rs"
+
+[dependencies]
+capnp       = { workspace = true }
+
+[build-dependencies]
+capnpc      = { workspace = true }

crates/quicproquo-proto/build.rs

@@ -0,0 +1,59 @@
+//! Build script for quicproquo-proto.
+//!
+//! Invokes the `capnp` compiler to generate Rust types from `.capnp` schemas
+//! located in the workspace-root `schemas/` directory.
+//!
+//! # Prerequisites
+//!
+//! The `capnp` CLI must be installed and on `PATH`.
+//!
+//! Debian/Ubuntu:  apt-get install capnproto
+//! macOS:          brew install capnp
+//! Docker:         see docker/Dockerfile
+
+use std::{env, path::PathBuf};
+
+fn main() {
+    let manifest_dir =
+        PathBuf::from(env::var("CARGO_MANIFEST_DIR").expect("CARGO_MANIFEST_DIR not set by Cargo"));
+
+    // Workspace root is two levels above this crate (quicproquo/crates/quicproquo-proto).
+    let workspace_root = manifest_dir
+        .join("../..")
+        .canonicalize()
+        .expect("could not canonicalize workspace root path");
+
+    let schemas_dir = workspace_root.join("schemas");
+
+    // Re-run this build script whenever any schema file changes.
+    println!(
+        "cargo:rerun-if-changed={}",
+        schemas_dir.join("auth.capnp").display()
+    );
+    println!(
+        "cargo:rerun-if-changed={}",
+        schemas_dir.join("delivery.capnp").display()
+    );
+    println!(
+        "cargo:rerun-if-changed={}",
+        schemas_dir.join("node.capnp").display()
+    );
+    println!(
+        "cargo:rerun-if-changed={}",
+        schemas_dir.join("federation.capnp").display()
+    );
+
+    capnpc::CompilerCommand::new()
+        // Treat `schemas/` as the include root so that inter-schema imports
+        // resolve correctly.
+        .src_prefix(&schemas_dir)
+        .file(schemas_dir.join("auth.capnp"))
+        .file(schemas_dir.join("delivery.capnp"))
+        .file(schemas_dir.join("node.capnp"))
+        .file(schemas_dir.join("federation.capnp"))
+        .run()
+        .expect(
+            "Cap'n Proto schema compilation failed. \
+             Is `capnp` installed? (apt-get install capnproto / brew install capnp)",
+        );
+}

crates/quicproquo-proto/src/lib.rs

@@ -0,0 +1,72 @@
+//! Cap'n Proto schemas, generated types, and serialisation helpers for quicproquo.
+//!
+//! Generated Cap'n Proto code emits unnecessary parentheses; allow per coding standards.
+#![allow(unused_parens)]
+
+//! # Design constraints
+//!
+//! This crate is intentionally restricted:
+//! - **No crypto** — key material never enters this crate.
+//! - **No I/O** — callers own transport; this crate only converts bytes ↔ types.
+//! - **No async** — pure synchronous data-layer code.
+//!
+//! # Generated code
+//!
+//! `build.rs` invokes `capnpc` at compile time and writes generated Rust source
+//! into `$OUT_DIR`. The `include!` macros below splice that code in as a module.
+
+// ── Generated types ───────────────────────────────────────────────────────────
+
+/// Cap'n Proto generated types for `schemas/auth.capnp`.
+///
+/// Do not edit this module by hand — it is entirely machine-generated.
+pub mod auth_capnp {
+    include!(concat!(env!("OUT_DIR"), "/auth_capnp.rs"));
+}
+
+/// Cap'n Proto generated types for `schemas/delivery.capnp`.
+///
+/// Do not edit this module by hand — it is entirely machine-generated.
+pub mod delivery_capnp {
+    include!(concat!(env!("OUT_DIR"), "/delivery_capnp.rs"));
+}
+
+/// Cap'n Proto generated types for `schemas/node.capnp`.
+///
+/// Do not edit this module by hand — it is entirely machine-generated.
+pub mod node_capnp {
+    include!(concat!(env!("OUT_DIR"), "/node_capnp.rs"));
+}
+
+/// Cap'n Proto generated types for `schemas/federation.capnp`.
+///
+/// Do not edit this module by hand — it is entirely machine-generated.
+pub mod federation_capnp {
+    include!(concat!(env!("OUT_DIR"), "/federation_capnp.rs"));
+}
+
+// ── Low-level byte ↔ message conversions ──────────────────────────────────────
+
+/// Serialise a Cap'n Proto message builder to unpacked wire bytes.
+///
+/// The output includes the segment table header. For transport, the
+/// `quicproquo-core` frame codec prepends a 4-byte little-endian length field.
+pub fn to_bytes<A: capnp::message::Allocator>(
+    msg: &capnp::message::Builder<A>,
+) -> Result<Vec<u8>, capnp::Error> {
+    let mut buf = Vec::new();
+    capnp::serialize::write_message(&mut buf, msg)?;
+    Ok(buf)
+}
+
+/// Deserialise unpacked wire bytes into a message with owned segments.
+///
+/// Uses `ReaderOptions::new()` (default limits: 64 MiB, 512 nesting levels).
+/// Callers that receive data from untrusted peers should consider tightening
+/// the traversal limit via `ReaderOptions::traversal_limit_in_words`.
+pub fn from_bytes(
+    bytes: &[u8],
+) -> Result<capnp::message::Reader<capnp::serialize::OwnedSegments>, capnp::Error> {
+    let mut cursor = std::io::Cursor::new(bytes);
+    capnp::serialize::read_message(&mut cursor, capnp::message::ReaderOptions::new())
+}