fix: auto-derive state file path from --username

qpq --username alice now automatically uses qpq-alice.bin instead of the
shared qpq-state.bin default, preventing identity collisions in multi-user
local test setups without requiring an explicit --state flag.

crates/quicproquo-client/src/main.rs

@@ -330,6 +330,21 @@ enum Command {
     },
 }
 
+// ── Helpers ───────────────────────────────────────────────────────────────────
+
+/// Returns `qpq-{username}.bin` when `state` is still at the default
+/// (`qpq-state.bin`) and a username has been provided. Otherwise returns
+/// `state` unchanged. This lets `qpq --username alice` automatically isolate
+/// Alice's state without requiring a manual `--state` flag.
+fn derive_state_path(state: PathBuf, username: Option<&str>) -> PathBuf {
+    if state == PathBuf::from("qpq-state.bin") {
+        if let Some(uname) = username {
+            return PathBuf::from(format!("qpq-{uname}.bin"));
+        }
+    }
+    state
+}
+
 // ── Entry point ───────────────────────────────────────────────────────────────
 
 #[tokio::main]
@@ -359,7 +374,7 @@ async fn main() -> anyhow::Result<()> {
     // Default to REPL when no subcommand is given.
     let no_server = args.no_server;
     let command = args.command.unwrap_or_else(|| Command::Repl {
-        state: args.state,
+        state: derive_state_path(args.state, args.username.as_deref()),
         server: args.server,
         username: args.username,
         password: args.password,
@@ -564,6 +579,7 @@ async fn main() -> anyhow::Result<()> {
             password,
             no_server,
         } => {
+            let state = derive_state_path(state, username.as_deref());
             let local = tokio::task::LocalSet::new();
             local
                 .run_until(run_repl(