feat: M2 + M3 — AuthService, MLS group lifecycle, Delivery Service

M2:
- schemas/auth.capnp: AuthenticationService (upload/fetch KeyPackage)
- noiseml-core: IdentityKeypair (Ed25519), generate_key_package, NoiseTransport
  with send_envelope/recv_envelope, Noise_XX handshake (initiator + responder)
- noiseml-proto: auth_capnp module, ParsedEnvelope helpers
- noiseml-server: AuthServiceImpl backed by DashMap queue (single-use KPs)
- noiseml-client: register + fetch-key subcommands, ping over Noise_XX
- tests: auth_service integration test (upload → fetch round-trip)

M3:
- schemas/delivery.capnp: DeliveryService (enqueue/fetch opaque payloads)
- noiseml-core/group.rs: GroupMember — MLS group lifecycle
  create_group, add_member (→ Commit+Welcome), join_group, send_message,
  receive_message; uses openmls 0.5 public API (extract() not into_welcome,
  KeyPackageIn::validate() not From<KeyPackageIn>)
- noiseml-server: DeliveryServiceImpl on port 7001 alongside AS on 7000
- noiseml-proto: delivery_capnp module

TODO (see M3_STATUS.md):
- noiseml-client: group subcommands (create-group, invite, join, send, recv)
- noiseml-client/tests/mls_group.rs: full MLS round-trip integration test

crates/noiseml-core/Cargo.toml

@@ -6,9 +6,7 @@ description = "Crypto primitives, Noise_XX transport, MLS state machine, and Cap
 license     = "MIT"
 
 [dependencies]
-# Crypto
-# openmls / openmls_rust_crypto / openmls_basic_credential — added in M2
-# ml-kem — added in M5 (hybrid PQ ciphersuite)
+# Crypto — classical
 x25519-dalek        = { workspace = true }
 ed25519-dalek       = { workspace = true }
 snow                = { workspace = true }
@@ -17,12 +15,20 @@ hkdf                = { workspace = true }
 zeroize             = { workspace = true }
 rand                = { workspace = true }
 
+# Crypto — MLS (M2); ml-kem added in M5
+openmls             = { workspace = true }
+openmls_rust_crypto = { workspace = true }
+openmls_traits      = { workspace = true }
+tls_codec           = { workspace = true }
+
 # Serialisation
 capnp               = { workspace = true }
 noiseml-proto       = { path = "../noiseml-proto" }
 
-# Async codec
+# Async runtime + codec
+tokio               = { workspace = true }
 tokio-util          = { workspace = true }
+futures             = { workspace = true }
 bytes               = { version = "1" }
 
 # Error handling