chore: ROADMAP Phase 8, parallel AI team script, docker and infra updates

- ROADMAP.md: add Phase 8 — Freifunk / Community Mesh Networking with
  F0-F8 checkboxes; F0-F2 marked complete
- scripts/ai_team.py: rewrite to support asyncio.gather parallel agent
  runs; add --sprint flag with predefined work packages (audit,
  phase1-hardening, phase2-tests, phase1-infra, status); add --parallel
  for ad-hoc concurrent agent invocations; output written to
  logs/ai_team/<sprint>_<timestamp>/<agent>.md
- scripts/dev-shell.sh: convenience development shell helper
- docker: update Dockerfiles for quicproquo rename and new server flags
- .gitignore: add qpq-state artifacts (*.bin, *.session, *.pending.ks,
  *.convdb*)

ROADMAP.md

@@ -352,6 +352,79 @@ Long-term vision for wide adoption.
 
 ---
 
+## Phase 8 — Freifunk / Community Mesh Networking
+
+Make qpq a first-class citizen on decentralised, community-operated wireless
+networks (Freifunk, BATMAN-adv/Babel routing, OpenWrt). Multiple qpq nodes form
+a federated mesh; clients auto-discover nearby nodes via mDNS; the network
+functions without any central infrastructure or internet uplink.
+
+### Architecture
+
+```
+  Client A ─── mDNS discovery ──► nearby qpq node (LAN / mesh)
+                                        │
+                               Cap'n Proto federation
+                                        │
+                               remote qpq node (across mesh)
+```
+
+- [x] **F0 — Re-include `quicproquo-p2p` in workspace; fix ALPN strings**
+  - Moved `crates/quicproquo-p2p` from `exclude` back into `[workspace] members`
+  - Fixed ALPN `b"quicnprotochat/p2p/1"` → `b"quicproquo/p2p/1"` (breaking wire change)
+  - Fixed federation ALPN `b"qnpc-fed"` → `b"quicproquo/federation/1"`
+  - Feature-gated behind `--features mesh` on client (keeps iroh out of default builds)
+
+- [x] **F1 — Federation routing in message delivery**
+  - `handle_enqueue` and `handle_batch_enqueue` call `federation::routing::resolve_destination()`
+  - Recipients with a remote home server are relayed via `FederationClient::relay_enqueue()`
+  - mTLS mutual authentication between nodes (both present client certs, validated against shared CA)
+  - Config: `QPQ_FEDERATION_LISTEN`, `QPQ_LOCAL_DOMAIN`, `QPQ_FEDERATION_CERT/KEY/CA`
+
+- [x] **F2 — mDNS local peer discovery**
+  - Server announces `_quicproquo._udp.local.` on startup via `mdns-sd`
+  - Client: `MeshDiscovery::start()` browses for nearby nodes (feature-gated)
+  - REPL commands: `/mesh peers` (scan + list), `/mesh server <host:port>` (note address)
+  - Nodes announce: `ver=1`, `server=<host:port>`, `domain=<local_domain>` TXT records
+
+- [ ] **F3 — Self-sovereign mesh identity**
+  - Keypair = identity; OPAQUE password auth becomes optional (opt-in for managed deployments)
+  - `--mesh` startup mode: no AS required, nodes accept any verifiable keypair
+  - Bootstrap trust via out-of-band key fingerprint exchange (QR code or short code)
+
+- [ ] **F4 — Store-and-forward with TTL**
+  - Add `ttl_secs: u32` to `Envelope` in `node.capnp`
+  - Relay nodes hold messages for offline peers up to TTL, then discard
+  - Gossip-style propagation: each hop decrements a hop counter
+  - Enables asynchronous messaging across intermittently connected mesh segments
+
+- [ ] **F5 — Lightweight broadcast channels**
+  - No MLS overhead; symmetric group key distributed out-of-band
+  - Gossip delivery: node broadcasts to all peers, peers re-broadcast once
+  - Loop prevention via bloom filter on seen message IDs
+  - Suitable for community bulletin boards, emergency broadcasts on mesh
+
+- [ ] **F6 — Extended `/mesh` REPL commands**
+  - `/mesh dm <fingerprint>` — direct message to peer by key fingerprint (P2P path)
+  - `/mesh broadcast <channel>` — publish to a symmetric broadcast channel
+  - `/mesh auto` — auto-select server with lowest RTT from discovered peers
+  - Auto-reconnect: if current server unreachable, fall back to next discovered peer
+
+- [ ] **F7 — OpenWrt cross-compilation guide**
+  - Musl static builds: `x86_64-unknown-linux-musl`, `armv7-unknown-linux-musleabihf`, `mips-unknown-linux-musl`
+  - Strip binary: `--release` + `strip` → target size < 5 MB for flash storage
+  - `opkg` package manifest for OpenWrt feed
+  - `procd` init script + `uci` config file for OpenWrt integration
+  - CI job: cross-compile and size-check on every release tag
+
+- [ ] **F8 — Traffic analysis resistance for mesh**
+  - Uniform message padding to nearest 256-byte boundary (hides message size)
+  - Configurable decoy traffic rate (fake messages to mask send timing)
+  - Optional onion routing: 3-hop relay through other mesh nodes (no Tor dependency)
+  - Ref: Phase 7.7 for server-side traffic analysis resistance
+
+---
+
 ## Summary Timeline
 
 | Phase | Focus | Estimated Effort |