feat: add post-quantum hybrid KEM + SQLCipher persistence

Feature 1 — Post-Quantum Hybrid KEM (X25519 + ML-KEM-768):
- Create hybrid_kem.rs with keygen, encrypt, decrypt + 11 unit tests
- Wire format: version(1) | x25519_eph_pk(32) | mlkem_ct(1088) | nonce(12) | ct
- Add uploadHybridKey/fetchHybridKey RPCs to node.capnp schema
- Server: hybrid key storage in FileBackedStore + RPC handlers
- Client: hybrid keypair in StoredState, auto-wrap/unwrap in send/recv/invite/join
- demo-group runs full hybrid PQ envelope round-trip

Feature 2 — SQLCipher Persistence:
- Extract Store trait from FileBackedStore API
- Create SqlStore (rusqlite + bundled-sqlcipher) with encrypted-at-rest SQLite
- Schema: key_packages, deliveries, hybrid_keys tables with indexes
- Server CLI: --store-backend=sql, --db-path, --db-key flags
- 5 unit tests for SqlStore (FIFO, round-trip, upsert, channel isolation)

Also includes: client lib.rs refactor, auth config, TOML config file support,
mdBook documentation, and various cleanups by user.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

crates/quicnprotochat-core/Cargo.toml

@@ -2,20 +2,23 @@
 name        = "quicnprotochat-core"
 version     = "0.1.0"
 edition     = "2021"
-description = "Crypto primitives, TLS/QUIC transport, MLS state machine, and Cap'n Proto frame codec for quicnprotochat."
+description = "Crypto primitives, MLS state machine, and hybrid post-quantum KEM for quicnprotochat."
 license     = "MIT"
 
 [dependencies]
 # Crypto — classical
 x25519-dalek        = { workspace = true }
 ed25519-dalek       = { workspace = true }
-snow                = { workspace = true }
 sha2                = { workspace = true }
 hkdf                = { workspace = true }
+chacha20poly1305    = { workspace = true }
 zeroize             = { workspace = true }
 rand                = { workspace = true }
 
-# Crypto — MLS (M2); ml-kem added in M5
+# Crypto — post-quantum hybrid KEM (M7)
+ml-kem              = { workspace = true }
+
+# Crypto — MLS (M2)
 openmls             = { workspace = true }
 openmls_rust_crypto = { workspace = true }
 openmls_traits      = { workspace = true }
@@ -28,11 +31,8 @@ serde_json          = { workspace = true }
 capnp               = { workspace = true }
 quicnprotochat-proto       = { path = "../quicnprotochat-proto" }
 
-# Async runtime + codec
+# Async runtime
 tokio               = { workspace = true }
-tokio-util          = { workspace = true }
-futures             = { workspace = true }
-bytes               = { version = "1" }
 
 # Error handling
 thiserror           = { workspace = true }