chore: prepare repository for public release

- Add split licensing: AGPL-3.0 for server, Apache-2.0/MIT for all
  other crates and SDKs (Signal-style)
- Add SECURITY.md with vulnerability disclosure policy
- Add CONTRIBUTING.md with build, test, and code standards
- Add "not audited" security disclaimer to README
- Add workspace package metadata (license, repository, keywords)
- Move internal planning docs to docs/internal/ (gitignored)

crates/quicproquo-server/Cargo.toml

@@ -1,9 +1,10 @@
 [package]
 name        = "quicproquo-server"
 version     = "0.1.0"
-edition     = "2021"
+edition.workspace     = true
 description = "Delivery Service and Authentication Service for quicproquo."
-license     = "MIT"
+license     = "AGPL-3.0-only"
+repository.workspace  = true
 
 [features]
 traffic-resistance = []