chore: prepare repository for public release

- Add split licensing: AGPL-3.0 for server, Apache-2.0/MIT for all
  other crates and SDKs (Signal-style)
- Add SECURITY.md with vulnerability disclosure policy
- Add CONTRIBUTING.md with build, test, and code standards
- Add "not audited" security disclaimer to README
- Add workspace package metadata (license, repository, keywords)
- Move internal planning docs to docs/internal/ (gitignored)

crates/quicproquo-plugin-api/Cargo.toml

@@ -1,9 +1,10 @@
 [package]
 name        = "quicproquo-plugin-api"
 version     = "0.1.0"
-edition     = "2021"
+edition.workspace     = true
 description = "C-ABI vtable for quicproquo server plugins. No std dependency; usable from bare-metal plugin authors."
-license     = "MIT"
+license     = "Apache-2.0 OR MIT"
+repository.workspace  = true
 
 [lints]
 workspace = true