chore: prepare repository for public release

- Add split licensing: AGPL-3.0 for server, Apache-2.0/MIT for all
  other crates and SDKs (Signal-style)
- Add SECURITY.md with vulnerability disclosure policy
- Add CONTRIBUTING.md with build, test, and code standards
- Add "not audited" security disclaimer to README
- Add workspace package metadata (license, repository, keywords)
- Move internal planning docs to docs/internal/ (gitignored)

.gitignore

@@ -17,3 +17,6 @@ data/
 *.convdb-wal
 *.pending.ks
 qpq-server.toml
+
+# Internal planning docs (not for public distribution)
+docs/internal/