feat: M2 + M3 — AuthService, MLS group lifecycle, Delivery Service

M2:
- schemas/auth.capnp: AuthenticationService (upload/fetch KeyPackage)
- noiseml-core: IdentityKeypair (Ed25519), generate_key_package, NoiseTransport
  with send_envelope/recv_envelope, Noise_XX handshake (initiator + responder)
- noiseml-proto: auth_capnp module, ParsedEnvelope helpers
- noiseml-server: AuthServiceImpl backed by DashMap queue (single-use KPs)
- noiseml-client: register + fetch-key subcommands, ping over Noise_XX
- tests: auth_service integration test (upload → fetch round-trip)

M3:
- schemas/delivery.capnp: DeliveryService (enqueue/fetch opaque payloads)
- noiseml-core/group.rs: GroupMember — MLS group lifecycle
  create_group, add_member (→ Commit+Welcome), join_group, send_message,
  receive_message; uses openmls 0.5 public API (extract() not into_welcome,
  KeyPackageIn::validate() not From<KeyPackageIn>)
- noiseml-server: DeliveryServiceImpl on port 7001 alongside AS on 7000
- noiseml-proto: delivery_capnp module

TODO (see M3_STATUS.md):
- noiseml-client: group subcommands (create-group, invite, join, send, recv)
- noiseml-client/tests/mls_group.rs: full MLS round-trip integration test

schemas/auth.capnp

@@ -0,0 +1,31 @@
+# auth.capnp — Authentication Service RPC interface.
+#
+# Clients call uploadKeyPackage before joining any group so that peers can
+# fetch their key material to add them. Each KeyPackage is single-use (MLS
+# requirement): fetchKeyPackage removes and returns one package atomically.
+#
+# The server indexes packages by the raw Ed25519 public key bytes (32 bytes),
+# not a fingerprint, so callers must know the target's identity public key
+# out-of-band (e.g. from a directory or QR code scan).
+#
+# ID generated with: capnp id
+@0xb3a8f1c2e4d97650;
+
+interface AuthenticationService {
+  # Upload a single-use KeyPackage for later retrieval by peers.
+  #
+  # identityKey : Ed25519 public key bytes (exactly 32 bytes).
+  # package     : openmls-serialised KeyPackage blob (TLS encoding).
+  #
+  # Returns the SHA-256 fingerprint of `package`. Clients should record this
+  # and compare it against the fingerprint returned by a peer's fetchKeyPackage
+  # to detect tampering.
+  uploadKeyPackage @0 (identityKey :Data, package :Data) -> (fingerprint :Data);
+
+  # Fetch and atomically remove one KeyPackage for a given identity key.
+  #
+  # Returns empty Data if no KeyPackage is currently stored for this identity.
+  # Callers should handle the empty case by asking the target to upload more
+  # packages before retrying.
+  fetchKeyPackage  @1 (identityKey :Data) -> (package :Data);
+}