chore: prepare repository for public release

- Add split licensing: AGPL-3.0 for server, Apache-2.0/MIT for all
  other crates and SDKs (Signal-style)
- Add SECURITY.md with vulnerability disclosure policy
- Add CONTRIBUTING.md with build, test, and code standards
- Add "not audited" security disclaimer to README
- Add workspace package metadata (license, repository, keywords)
- Move internal planning docs to docs/internal/ (gitignored)

Cargo.toml

@@ -14,6 +14,14 @@ members = [
     "crates/quicproquo-p2p",
 ]
 
+[workspace.package]
+edition     = "2021"
+rust-version = "1.75"
+repository  = "https://github.com/quicproquo/quicproquo"
+description = "End-to-end encrypted group messaging over QUIC"
+keywords    = ["encryption", "messaging", "quic", "mls", "post-quantum"]
+categories  = ["cryptography", "network-programming"]
+
 # Shared dependency versions — bump here to affect the whole workspace.
 [workspace.dependencies]