feat: parliament daemon, login gate, peer context sync (0.9.13)

Login claims the chair, writes a session ticket, and starts a background
service for discovery plus revision-based context sync. Password Realm
opens require --login (or CST_REALM_PASSWORD); --service/--service-stop
manage the resident agent.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/test_parliament.c

@@ -44,6 +44,8 @@ int main(void) {
   assert(cst_parliament_load(&m) == 0);
   assert(!strcmp(m.chair_instance, "laptop-2"));
 
+  assert(cst_parliament_session_ok(NULL, 0));
+
   assert(cst_parliament_new_project("proj-b") == 0);
   char *ctx = cst_parliament_context_get();
   assert(ctx && ctx[0] == 0);
@@ -51,6 +53,16 @@ int main(void) {
   assert(cst_parliament_load(&m) == 0);
   assert(!strcmp(m.project_id, "proj-b"));
   assert(m.chair_instance[0] == 0);
+  assert(!cst_parliament_session_ok(NULL, 0));
+
+  assert(cst_parliament_apply_sync(9, "parl-x", "proj-c", "chair-z",
+                                   "synced-body") == 0);
+  ctx = cst_parliament_context_get();
+  assert(ctx && strstr(ctx, "synced-body"));
+  free(ctx);
+  assert(cst_parliament_load(&m) == 0);
+  assert(m.revision == 9);
+  assert(!strcmp(m.chair_instance, "chair-z"));
 
   test_rmrf(dir);
   puts("test_parliament: OK");

tests/test_peer_auth.c

@@ -24,8 +24,10 @@ static void *server_main(void *p) {
   char err[128];
   s->ok = cst_peer_accept((intptr_t)s->listen, &s->cert, s->sk, s->realm_pk,
                           5000, &sess, err, sizeof(err)) == 0;
-  if (s->ok)
+  if (s->ok) {
     snprintf(s->remote_id, sizeof(s->remote_id), "%s", sess.remote.instance_id);
+    cst_peer_close(&sess);
+  }
   return NULL;
 }
 
@@ -55,6 +57,7 @@ int main(void) {
   assert(cst_peer_dial("127.0.0.1", port, &ca, ska, realm.pk, 5000, &sess, err,
                        sizeof(err)) == 0);
   assert(!strcmp(sess.remote.instance_id, "peer-b"));
+  cst_peer_close(&sess);
   pthread_join(th, NULL);
   assert(srv.ok);
   assert(!strcmp(srv.remote_id, "peer-a"));