feat: Phase 9 — developer experience, extensibility, and community growth

New crates:
- quicproquo-bot: Bot SDK with polling API + JSON pipe mode
- quicproquo-kt: Key Transparency Merkle log (RFC 9162 subset)
- quicproquo-plugin-api: no_std C-compatible plugin vtable API
- quicproquo-gen: scaffolding tool (qpq-gen plugin/bot/rpc/hook)

Server features:
- ServerHooks trait wired into all RPC handlers (enqueue, fetch, auth,
  channel, registration) with plugin rejection support
- Dynamic plugin loader (libloading) with --plugin-dir config
- Delivery proof canary tokens (Ed25519 server signatures on enqueue)
- Key Transparency Merkle log with inclusion proofs on resolveUser

Core library:
- Safety numbers (60-digit HMAC-SHA256 key verification codes)
- Verifiable transcript archive (CBOR + ChaCha20-Poly1305 + hash chain)
- Delivery proof verification utility
- Criterion benchmarks (hybrid KEM, MLS, identity, sealed sender, padding)

Client:
- /verify REPL command for out-of-band key verification
- Full-screen TUI via Ratatui (feature-gated --features tui)
- qpq export / qpq export-verify CLI subcommands
- KT inclusion proof verification on user resolution

Also: ROADMAP Phase 9 added, bot SDK docs, server hooks docs,
crate-responsibilities updated, example plugins (rate_limit, logging).

docs/src/architecture/crate-responsibilities.md

@@ -200,6 +200,39 @@ group state to disk.
 
 ---
 
+## quicproquo-bot
+
+**Role:** High-level SDK for building automated agents (bots) on the
+quicproquo network. Wraps the client library into a simple polling-based API.
+
+### Components
+
+| Component        | Description |
+|------------------|-------------|
+| `BotConfig`      | Builder-pattern configuration: server address, credentials, TLS, state file path. |
+| `Bot`            | Connected bot instance. Methods: `connect()`, `send_dm()`, `receive()`, `receive_raw()`, `resolve_user()`. |
+| `Message`        | Received message struct with `sender`, `text`, and `seq` fields. |
+| `run_pipe_mode`  | JSON-lines stdin/stdout interface for shell integration (`send`, `recv`, `resolve` actions). |
+
+### Architecture
+
+Each `send_dm` and `receive` call opens a fresh QUIC connection (stateless
+reconnect pattern). The bot wraps the client's `cmd_send` and
+`receive_pending_plaintexts` functions, handling MLS group state internally.
+
+### What this crate does NOT do
+
+- No server-side logic.
+- No raw MLS operations — delegates to `quicproquo-client` high-level functions.
+- No persistent QUIC connections — each operation reconnects.
+
+### Key dependencies
+
+`quicproquo-core`, `quicproquo-client`, `tokio`, `anyhow`, `tracing`,
+`serde`, `serde_json`, `hex`.
+
+---
+
 ## Other workspace crates
 
 | Crate                   | Role |