feat: Phase 9 — developer experience, extensibility, and community growth

New crates:
- quicproquo-bot: Bot SDK with polling API + JSON pipe mode
- quicproquo-kt: Key Transparency Merkle log (RFC 9162 subset)
- quicproquo-plugin-api: no_std C-compatible plugin vtable API
- quicproquo-gen: scaffolding tool (qpq-gen plugin/bot/rpc/hook)

Server features:
- ServerHooks trait wired into all RPC handlers (enqueue, fetch, auth,
  channel, registration) with plugin rejection support
- Dynamic plugin loader (libloading) with --plugin-dir config
- Delivery proof canary tokens (Ed25519 server signatures on enqueue)
- Key Transparency Merkle log with inclusion proofs on resolveUser

Core library:
- Safety numbers (60-digit HMAC-SHA256 key verification codes)
- Verifiable transcript archive (CBOR + ChaCha20-Poly1305 + hash chain)
- Delivery proof verification utility
- Criterion benchmarks (hybrid KEM, MLS, identity, sealed sender, padding)

Client:
- /verify REPL command for out-of-band key verification
- Full-screen TUI via Ratatui (feature-gated --features tui)
- qpq export / qpq export-verify CLI subcommands
- KT inclusion proof verification on user resolution

Also: ROADMAP Phase 9 added, bot SDK docs, server hooks docs,
crate-responsibilities updated, example plugins (rate_limit, logging).

docker/Dockerfile

@@ -64,12 +64,23 @@ RUN apt-get update \
 
 COPY --from=builder /build/target/release/qpq-server /usr/local/bin/qpq-server
 
+# Create a dedicated non-root user with a writable data directory.
+RUN groupadd --system qpq \
+    && useradd --system --gid qpq --no-create-home --shell /usr/sbin/nologin qpq \
+    && mkdir -p /var/lib/quicproquo \
+    && chown qpq:qpq /var/lib/quicproquo
+
 EXPOSE 7000
 
 ENV RUST_LOG=info \
-    QPQ_LISTEN=0.0.0.0:7000
+    QPQ_LISTEN=0.0.0.0:7000 \
+    QPQ_DATA_DIR=/var/lib/quicproquo \
+    QPQ_TLS_CERT=/var/lib/quicproquo/server-cert.der \
+    QPQ_TLS_KEY=/var/lib/quicproquo/server-key.der
 
-# Run as a non-root user.
-USER nobody
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
+    CMD test -f /var/lib/quicproquo/server-cert.der || exit 1
+
+USER qpq
 
 CMD ["qpq-server"]