feat: add traffic analysis resistance (Phase 7.7 + F8)

- Core: add pad_uniform/unpad_uniform for configurable boundary padding
  and generate_decoy for indistinguishable decoy messages
- Server: add traffic_resistance module with payload padding, timing
  jitter, and background decoy traffic generator (feature-gated)
- P2P: add mesh traffic_resistance module with padded envelopes and
  mesh decoy injection (feature-gated)
- All gated behind --features traffic-resistance
- 22 new tests across core (8), server (4), and P2P (5)

crates/quicproquo-server/Cargo.toml

@@ -5,6 +5,10 @@ edition     = "2021"
 description = "Delivery Service and Authentication Service for quicproquo."
 license     = "MIT"
 
+[features]
+traffic-resistance = []
+webtransport = ["dep:h3", "dep:h3-quinn", "dep:h3-webtransport", "dep:http"]
+
 [[bin]]
 name = "qpq-server"
 path = "src/main.rs"
@@ -73,6 +77,12 @@ metrics-exporter-prometheus = "0.15"
 # mDNS service announcement for local mesh / Freifunk node discovery.
 mdns-sd = "0.12"
 
+# WebTransport (HTTP/3) — feature-gated, for browser clients.
+h3                = { version = "0.0.8", optional = true }
+h3-quinn          = { version = "0.0.10", optional = true }
+h3-webtransport   = { version = "0.1", optional = true }
+http              = { version = "1", optional = true }
+
 [lints]
 workspace = true