feat: add post-quantum hybrid KEM + SQLCipher persistence

Feature 1 — Post-Quantum Hybrid KEM (X25519 + ML-KEM-768):
- Create hybrid_kem.rs with keygen, encrypt, decrypt + 11 unit tests
- Wire format: version(1) | x25519_eph_pk(32) | mlkem_ct(1088) | nonce(12) | ct
- Add uploadHybridKey/fetchHybridKey RPCs to node.capnp schema
- Server: hybrid key storage in FileBackedStore + RPC handlers
- Client: hybrid keypair in StoredState, auto-wrap/unwrap in send/recv/invite/join
- demo-group runs full hybrid PQ envelope round-trip

Feature 2 — SQLCipher Persistence:
- Extract Store trait from FileBackedStore API
- Create SqlStore (rusqlite + bundled-sqlcipher) with encrypted-at-rest SQLite
- Schema: key_packages, deliveries, hybrid_keys tables with indexes
- Server CLI: --store-backend=sql, --db-path, --db-key flags
- 5 unit tests for SqlStore (FIFO, round-trip, upsert, channel isolation)

Also includes: client lib.rs refactor, auth config, TOML config file support,
mdBook documentation, and various cleanups by user.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/src/getting-started/prerequisites.md

@@ -0,0 +1,101 @@
+# Prerequisites
+
+Before building quicnprotochat you need a Rust toolchain and the Cap'n Proto schema compiler. Docker is optional but useful for reproducible builds and deployment.
+
+---
+
+## Rust toolchain
+
+**Minimum supported Rust version: 1.77+ (stable)**
+
+quicnprotochat uses the 2021 edition and workspace resolver v2. Any stable Rust release from 1.77 onward should work. Install or update via [rustup](https://rustup.rs/):
+
+```bash
+# Install rustup (if not already present)
+curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
+
+# Ensure you are on a recent stable release
+rustup update stable
+rustup default stable
+
+# Verify
+rustc --version   # should print 1.77.0 or later
+cargo --version
+```
+
+The workspace depends on several crates that use procedural macros (`serde_derive`, `clap_derive`, `tls_codec_derive`, `thiserror`). These compile during the build step and require no additional system libraries beyond what `rustc` ships.
+
+---
+
+## Cap'n Proto compiler (`capnp`)
+
+The `quicnprotochat-proto` crate runs a `build.rs` script that invokes the `capnp` binary at compile time to generate Rust types from the `.capnp` schema files in `schemas/`. The `capnp` binary must be on your `PATH`.
+
+### Debian / Ubuntu
+
+```bash
+sudo apt-get update
+sudo apt-get install -y capnproto
+```
+
+### macOS (Homebrew)
+
+```bash
+brew install capnp
+```
+
+### Verify installation
+
+```bash
+capnp --version
+# Expected output: Cap'n Proto version X.Y.Z
+```
+
+If `capnp` is not found, the build will fail with an error from `capnpc::CompilerCommand`:
+
+```
+Cap'n Proto schema compilation failed. Is `capnp` installed?
+(apt-get install capnproto / brew install capnp)
+```
+
+See [Building from Source -- Troubleshooting](building.md#troubleshooting) for more details.
+
+### Other platforms
+
+| Platform | Install command |
+|---|---|
+| Fedora / RHEL | `dnf install capnproto` |
+| Arch Linux | `pacman -S capnproto` |
+| Nix | `nix-env -iA nixpkgs.capnproto` |
+| Windows (vcpkg) | `vcpkg install capnproto` |
+| From source | [capnproto.org/install.html](https://capnproto.org/install.html) |
+
+---
+
+## Optional: Docker and Docker Compose
+
+If you prefer to build and run quicnprotochat in containers, you will need:
+
+- **Docker Engine** 20.10+ (or Docker Desktop)
+- **Docker Compose** v2+ (the `docker compose` plugin, not the legacy `docker-compose` binary)
+
+```bash
+docker --version          # 20.10+
+docker compose version    # v2+
+```
+
+The provided `docker/Dockerfile` is a multi-stage build that installs `capnproto` in the builder stage, so you do **not** need the `capnp` binary on your host when building via Docker.
+
+See [Docker Deployment](docker.md) for full instructions.
+
+---
+
+## Summary checklist
+
+| Dependency | Required? | How to check |
+|---|---|---|
+| Rust stable 1.77+ | Yes | `rustc --version` |
+| `capnp` CLI | Yes (host builds) | `capnp --version` |
+| Docker + Compose | No (container builds only) | `docker --version` / `docker compose version` |
+
+Once all prerequisites are satisfied, proceed to [Building from Source](building.md).