feat: mutual Realm peer handshake over TCP (0.9.11)

Exchange enrolled certificates and Ed25519 challenge signatures so
same-Realm instances can authenticate each other after discovery.

Co-authored-by: Cursor <cursoragent@cursor.com>

include/cst_peer.h

@@ -0,0 +1,36 @@
+#ifndef CST_PEER_H
+#define CST_PEER_H
+
+#include "cst_realm.h"
+#include <stdint.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Mutual Realm certificate challenge over TCP (cleartext for now; TLS wrap
+ * is the next slice). Same Realm public key required on both sides. */
+
+typedef struct {
+  cst_realm_cert_t remote;
+  char host[64];
+  int port;
+} cst_peer_session_t;
+
+/* Dial host:port, prove our cert, verify theirs. 0 on success. */
+int cst_peer_dial(const char *host, int port, const cst_realm_cert_t *self,
+                  const uint8_t self_sk[64], const uint8_t realm_pk[32],
+                  int timeout_ms, cst_peer_session_t *out, char *err,
+                  size_t err_sz);
+
+/* Accept one connection on listening socket (from os_net_listen). */
+int cst_peer_accept(intptr_t listen_sock, const cst_realm_cert_t *self,
+                    const uint8_t self_sk[64], const uint8_t realm_pk[32],
+                    int timeout_ms, cst_peer_session_t *out, char *err,
+                    size_t err_sz);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

include/cst_version.h

@@ -3,7 +3,7 @@
 
 #define CST_VERSION_MAJOR 0
 #define CST_VERSION_MINOR 9
-#define CST_VERSION_PATCH 10
+#define CST_VERSION_PATCH 11
 
 #define CST_VERSION_STR_(x) #x
 #define CST_VERSION_STR(x) CST_VERSION_STR_(x)