chore: prepare repository for public release

- Add split licensing: AGPL-3.0 for server, Apache-2.0/MIT for all
  other crates and SDKs (Signal-style)
- Add SECURITY.md with vulnerability disclosure policy
- Add CONTRIBUTING.md with build, test, and code standards
- Add "not audited" security disclaimer to README
- Add workspace package metadata (license, repository, keywords)
- Move internal planning docs to docs/internal/ (gitignored)

crates/quicproquo-client/Cargo.toml

@@ -1,9 +1,10 @@
 [package]
 name        = "quicproquo-client"
 version     = "0.1.0"
-edition     = "2021"
+edition.workspace     = true
 description = "CLI client for quicproquo."
-license     = "MIT"
+license     = "Apache-2.0 OR MIT"
+repository.workspace  = true
 
 [[bin]]
 name = "qpq"

crates/quicproquo-core/Cargo.toml

@@ -1,9 +1,10 @@
 [package]
 name        = "quicproquo-core"
 version     = "0.1.0"
-edition     = "2021"
+edition.workspace     = true
 description = "Crypto primitives, MLS state machine, and hybrid post-quantum KEM for quicproquo."
-license     = "MIT"
+license     = "Apache-2.0 OR MIT"
+repository.workspace  = true
 
 [features]
 default = ["native"]

crates/quicproquo-kt/Cargo.toml

@@ -1,9 +1,10 @@
 [package]
 name        = "quicproquo-kt"
 version     = "0.1.0"
-edition     = "2021"
+edition.workspace     = true
 description = "Key Transparency: append-only SHA-256 Merkle log for (username, identity_key) bindings."
-license     = "MIT"
+license     = "Apache-2.0 OR MIT"
+repository.workspace  = true
 
 [lints]
 workspace = true

crates/quicproquo-p2p/Cargo.toml

@@ -1,9 +1,10 @@
 [package]
 name        = "quicproquo-p2p"
 version     = "0.1.0"
-edition     = "2021"
+edition.workspace     = true
 description = "P2P transport layer for quicproquo using iroh."
-license     = "MIT"
+license     = "Apache-2.0 OR MIT"
+repository.workspace  = true
 
 [features]
 traffic-resistance = []

crates/quicproquo-plugin-api/Cargo.toml

@@ -1,9 +1,10 @@
 [package]
 name        = "quicproquo-plugin-api"
 version     = "0.1.0"
-edition     = "2021"
+edition.workspace     = true
 description = "C-ABI vtable for quicproquo server plugins. No std dependency; usable from bare-metal plugin authors."
-license     = "MIT"
+license     = "Apache-2.0 OR MIT"
+repository.workspace  = true
 
 [lints]
 workspace = true

crates/quicproquo-proto/Cargo.toml

@@ -1,8 +1,10 @@
 [package]
 name = "quicproquo-proto"
 version = "0.2.0"
-edition = "2021"
+edition.workspace = true
 description = "Protocol types for quicproquo — v1 Cap'n Proto (legacy) + v2 Protobuf (prost)"
+license     = "Apache-2.0 OR MIT"
+repository.workspace = true
 
 build = "build.rs"
 

crates/quicproquo-rpc/Cargo.toml

@@ -1,8 +1,10 @@
 [package]
 name = "quicproquo-rpc"
 version = "0.1.0"
-edition = "2021"
+edition.workspace = true
 description = "QUIC RPC framework for quicproquo v2 — framing, dispatch, tower middleware"
+license     = "Apache-2.0 OR MIT"
+repository.workspace = true
 
 [dependencies]
 quicproquo-proto = { path = "../quicproquo-proto" }

crates/quicproquo-sdk/Cargo.toml

@@ -1,8 +1,10 @@
 [package]
 name = "quicproquo-sdk"
 version = "0.1.0"
-edition = "2021"
+edition.workspace = true
 description = "Client SDK for quicproquo v2 — connect, auth, send, receive, subscribe"
+license     = "Apache-2.0 OR MIT"
+repository.workspace = true
 
 [dependencies]
 quicproquo-core  = { path = "../quicproquo-core" }

crates/quicproquo-server/Cargo.toml

@@ -1,9 +1,10 @@
 [package]
 name        = "quicproquo-server"
 version     = "0.1.0"
-edition     = "2021"
+edition.workspace     = true
 description = "Delivery Service and Authentication Service for quicproquo."
-license     = "MIT"
+license     = "AGPL-3.0-only"
+repository.workspace  = true
 
 [features]
 traffic-resistance = []