feat: add Realm Ed25519 keys and instance enrollment (0.9.9)

Introduce a user Realm keypair (Monocypher) that signs instance
certificates so same-domain peers can later auto-discover and connect.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/test_realm.c

@@ -0,0 +1,69 @@
+#define _POSIX_C_SOURCE 200809L
+#include "cst_realm.h"
+#include "cst_test_util.h"
+
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+int main(void) {
+  char dir[2048];
+  assert(!test_tmpdir(dir, sizeof(dir), "realm"));
+
+  cst_realm_keys_t realm;
+  assert(cst_realm_generate(&realm) == 0);
+  assert(cst_realm_save(dir, &realm) == 0);
+
+  cst_realm_keys_t loaded;
+  assert(cst_realm_load(dir, &loaded) == 0);
+  assert(memcmp(loaded.pk, realm.pk, 32) == 0);
+
+  char fp[33], fp2[33];
+  assert(cst_realm_fingerprint(realm.pk, fp) == 0);
+  assert(cst_realm_fingerprint(loaded.pk, fp2) == 0);
+  assert(!strcmp(fp, fp2));
+  assert(strlen(fp) == 32);
+
+  cst_realm_cert_t cert;
+  uint8_t iseed[32], isk[64];
+  assert(cst_realm_enroll(&realm, "inst-a", "laptop", 0, &cert, iseed, isk) == 0);
+  assert(cst_realm_verify_cert(realm.pk, &cert, time(NULL)) == 0);
+
+  char *json = cst_realm_cert_to_json(&cert);
+  assert(json && strstr(json, "inst-a"));
+  cst_realm_cert_t parsed;
+  assert(cst_realm_cert_from_json(json, &parsed) == 0);
+  free(json);
+  assert(cst_realm_verify_cert(realm.pk, &parsed, time(NULL)) == 0);
+  assert(!strcmp(parsed.instance_id, "inst-a"));
+
+  uint8_t chal[32];
+  memset(chal, 0x5a, sizeof(chal));
+  uint8_t sig[64];
+  assert(cst_realm_challenge_sign(isk, chal, sizeof(chal), sig) == 0);
+  assert(cst_realm_challenge_check(&cert, chal, sizeof(chal), sig) == 0);
+  sig[0] ^= 1;
+  assert(cst_realm_challenge_check(&cert, chal, sizeof(chal), sig) != 0);
+
+  /* Foreign realm cannot verify. */
+  cst_realm_keys_t other;
+  assert(cst_realm_generate(&other) == 0);
+  assert(cst_realm_verify_cert(other.pk, &cert, time(NULL)) != 0);
+
+  /* Expiry. */
+  cst_realm_cert_t expired;
+  uint8_t s2[32], sk2[64];
+  assert(cst_realm_enroll(&realm, "inst-old", "old", 10, &expired, s2, sk2) == 0);
+  assert(cst_realm_verify_cert(realm.pk, &expired, 100) != 0);
+  assert(cst_realm_verify_cert(realm.pk, &expired, 5) == 0);
+
+  assert(cst_realm_revoke_add(dir, "inst-a") == 0);
+  assert(cst_realm_revoked(dir, "inst-a"));
+  assert(!cst_realm_revoked(dir, "inst-b"));
+
+  test_rmrf(dir);
+  puts("test_realm: OK");
+  return 0;
+}