feat: password Realm, single-chair login, shared parliament context (0.9.12)

Derive Realm keys from a user password (Argon2id, no private key on disk).
Login claims the sole chair with handover; peers share parliament context;
--new-project clears it. CLI peer/discover helpers and Docker alpine recipe
included; headless empty-answer retries raised for unattended runs.

Co-authored-by: Cursor <cursoragent@cursor.com>

include/cst_realm.h

@@ -36,6 +36,15 @@ int cst_realm_load(const char *dir, cst_realm_keys_t *out);
 /* 32 hex chars (blake2b-128 of pk). */
 int cst_realm_fingerprint(const uint8_t pk[32], char out[33]);
 
+/* Password-string Realm: Argon2id(password, salt) → seed. Private key is not
+ * stored; only salt + public.key live on disk. Unlock derives sk in memory. */
+int cst_realm_derive_password(cst_realm_keys_t *out, const char *password,
+                              const uint8_t salt[16]);
+int cst_realm_init_password(const char *dir, const char *password);
+int cst_realm_unlock_password(const char *dir, const char *password,
+                              cst_realm_keys_t *out);
+int cst_realm_is_password_mode(const char *dir);
+
 int cst_realm_enroll(const cst_realm_keys_t *realm, const char *instance_id,
                      const char *label, int64_t not_after, cst_realm_cert_t *cert,
                      uint8_t instance_seed[32], uint8_t instance_sk[64]);
@@ -52,6 +61,12 @@ int cst_realm_challenge_check(const cst_realm_cert_t *cert, const void *chal,
 int cst_realm_revoke_add(const char *dir, const char *instance_id);
 int cst_realm_revoked(const char *dir, const char *instance_id);
 
+/* Persist an enrolled instance under <realm>/instances/<id>/. */
+int cst_realm_instance_save(const char *instance_id, const cst_realm_cert_t *cert,
+                            const uint8_t instance_seed[32]);
+int cst_realm_instance_load(const char *instance_id, cst_realm_cert_t *cert,
+                            uint8_t instance_sk[64]);
+
 #ifdef __cplusplus
 }
 #endif