feat: add Realm Ed25519 keys and instance enrollment (0.9.9)

Introduce a user Realm keypair (Monocypher) that signs instance
certificates so same-domain peers can later auto-discover and connect.

Co-authored-by: Cursor <cursoragent@cursor.com>

Makefile

@@ -2,6 +2,7 @@ CC ?= gcc
 CFLAGS ?= -std=c11 -Wall -Wextra -O2 -g
 SD_DIR := vendor/sashidown
 CJSON_DIR := vendor/cjson
+MONO_DIR := vendor/monocypher
 PKG_CONFIG ?= pkg-config
 PREFIX ?= /usr/local
 DESTDIR ?=
@@ -60,6 +61,10 @@ CST_WEBUI ?= 1
 PKG_CFLAGS := $(CURL_CFLAGS) $(CURSES_CFLAGS)
 PKG_LIBS := $(CURL_LIBS) $(CURSES_LIBS)
 
+# Upstream Monocypher: keep -Werror builds green without patching the vendor.
+$(MONO_DIR)/monocypher.o $(MONO_DIR)/monocypher-ed25519.o: %.o: %.c
+	$(CC) $(CFLAGS) $(CPPFLAGS) -w -c -o $@ $<
+
 # tcc writes no rpath of its own, so shared libs found via pkg-config -L
 # (Nix store, /opt prefixes) would not load at run time.
 RPATH_LIBS :=
@@ -70,7 +75,8 @@ endif
 endif
 
 # Keep POSIX declarations visible for shared test helpers (notably symlink()).
-CPPFLAGS += -Iinclude -I.gen -I$(SD_DIR)/include -I$(CJSON_DIR) -D_POSIX_C_SOURCE=200809L -D_XOPEN_SOURCE_EXTENDED $(PKG_CFLAGS)
+CPPFLAGS += -Iinclude -I.gen -I$(SD_DIR)/include -I$(CJSON_DIR) -I$(MONO_DIR) \
+	-D_POSIX_C_SOURCE=200809L -D_XOPEN_SOURCE_EXTENDED $(PKG_CFLAGS)
 LDFLAGS += -L$(SD_DIR)
 LDLIBS += -lsashidown -lm $(PKG_LIBS) $(PTHREAD_LIBS) $(RPATH_LIBS)
 
@@ -87,6 +93,8 @@ endif
 
 CORE_SRC = \
 	$(CJSON_DIR)/cJSON.c \
+	$(MONO_DIR)/monocypher.c \
+	$(MONO_DIR)/monocypher-ed25519.c \
 	src/util.c \
 	src/ctl_parse.c \
 	src/os_compat.c \
@@ -97,7 +105,7 @@ CORE_SRC = \
 	src/skills.c \
 	src/extensions.c src/plugins.c src/mcp.c src/subagent.c src/attach.c src/clipboard.c \
 	src/pdf_text.c \
-	src/session.c src/runtime.c src/worktree.c \
+	src/session.c src/runtime.c src/worktree.c src/realm.c \
 	src/tools/tools.c \
 	src/tools/patch.c \
 	src/tools/registry.c \
@@ -165,6 +173,7 @@ TESTS = \
 	tests/test_mcp \
 	tests/test_subagent \
 	tests/test_runtime \
+	tests/test_realm \
 	tests/test_lowil \
 	tests/test_win_utf8 \
 	tests/test_os_dir \