feat: add post-quantum hybrid KEM + SQLCipher persistence

Feature 1 — Post-Quantum Hybrid KEM (X25519 + ML-KEM-768):
- Create hybrid_kem.rs with keygen, encrypt, decrypt + 11 unit tests
- Wire format: version(1) | x25519_eph_pk(32) | mlkem_ct(1088) | nonce(12) | ct
- Add uploadHybridKey/fetchHybridKey RPCs to node.capnp schema
- Server: hybrid key storage in FileBackedStore + RPC handlers
- Client: hybrid keypair in StoredState, auto-wrap/unwrap in send/recv/invite/join
- demo-group runs full hybrid PQ envelope round-trip

Feature 2 — SQLCipher Persistence:
- Extract Store trait from FileBackedStore API
- Create SqlStore (rusqlite + bundled-sqlcipher) with encrypted-at-rest SQLite
- Schema: key_packages, deliveries, hybrid_keys tables with indexes
- Server CLI: --store-backend=sql, --db-path, --db-key flags
- 5 unit tests for SqlStore (FIFO, round-trip, upsert, channel isolation)

Also includes: client lib.rs refactor, auth config, TOML config file support,
mdBook documentation, and various cleanups by user.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -4,14 +4,14 @@ services:
       context: .
       dockerfile: docker/Dockerfile
     ports:
-      - "4201:4201"
+      - "7000:7000"
     environment:
       RUST_LOG: "info"
-      QUICNPROTOCHAT_LISTEN: "0.0.0.0:4201"
-    # Healthcheck: attempt a TCP connection to port 4201.
+      QUICNPROTOCHAT_LISTEN: "0.0.0.0:7000"
+    # Healthcheck: attempt a TCP connection to port 7000.
     # Uses bash /dev/tcp — available in debian:bookworm-slim without extra packages.
     healthcheck:
-      test: ["CMD", "bash", "-c", "echo '' > /dev/tcp/localhost/4201"]
+      test: ["CMD", "bash", "-c", "echo '' > /dev/tcp/localhost/7000"]
       interval: 5s
       timeout: 3s
       retries: 10