feat: M2 + M3 — AuthService, MLS group lifecycle, Delivery Service

M2:
- schemas/auth.capnp: AuthenticationService (upload/fetch KeyPackage)
- noiseml-core: IdentityKeypair (Ed25519), generate_key_package, NoiseTransport
  with send_envelope/recv_envelope, Noise_XX handshake (initiator + responder)
- noiseml-proto: auth_capnp module, ParsedEnvelope helpers
- noiseml-server: AuthServiceImpl backed by DashMap queue (single-use KPs)
- noiseml-client: register + fetch-key subcommands, ping over Noise_XX
- tests: auth_service integration test (upload → fetch round-trip)

M3:
- schemas/delivery.capnp: DeliveryService (enqueue/fetch opaque payloads)
- noiseml-core/group.rs: GroupMember — MLS group lifecycle
  create_group, add_member (→ Commit+Welcome), join_group, send_message,
  receive_message; uses openmls 0.5 public API (extract() not into_welcome,
  KeyPackageIn::validate() not From<KeyPackageIn>)
- noiseml-server: DeliveryServiceImpl on port 7001 alongside AS on 7000
- noiseml-proto: delivery_capnp module

TODO (see M3_STATUS.md):
- noiseml-client: group subcommands (create-group, invite, join, send, recv)
- noiseml-client/tests/mls_group.rs: full MLS round-trip integration test

Cargo.toml

@@ -13,7 +13,10 @@ members = [
 # ── Crypto ────────────────────────────────────────────────────────────────────
 openmls            = { version = "0.5", default-features = false, features = ["crypto-subtle"] }
 openmls_rust_crypto = { version = "0.2" }
-openmls_basic_credential = { version = "0.2" }
+openmls_traits     = { version = "0.2" }
+# tls_codec must match the version used by openmls 0.5 (which uses 0.3) to avoid
+# duplicate Serialize trait versions in the dependency graph.
+tls_codec          = { version = "0.3", features = ["derive"] }
 # ml-kem 0.2 is the current stable release (FIPS 203, ML-KEM-768).
 # All three parameter sets (512/768/1024) are compiled in by default — no feature flag needed.
 ml-kem             = { version = "0.2" }
@@ -31,7 +34,7 @@ capnp-rpc          = { version = "0.19" }
 
 # ── Async / networking ────────────────────────────────────────────────────────
 tokio              = { version = "1", features = ["full"] }
-tokio-util         = { version = "0.7", features = ["codec"] }
+tokio-util         = { version = "0.7", features = ["codec", "compat"] }
 futures            = { version = "0.3" }
 
 # ── Server utilities ──────────────────────────────────────────────────────────
@@ -44,7 +47,7 @@ anyhow             = { version = "1" }
 thiserror          = { version = "1" }
 
 # ── CLI ───────────────────────────────────────────────────────────────────────
-clap               = { version = "4", features = ["derive"] }
+clap               = { version = "4", features = ["derive", "env"] }
 
 # ── Build-time ────────────────────────────────────────────────────────────────
 capnpc             = { version = "0.19" }