feat: add Realm Ed25519 keys and instance enrollment (0.9.9)

Introduce a user Realm keypair (Monocypher) that signs instance
certificates so same-domain peers can later auto-discover and connect.

Co-authored-by: Cursor <cursoragent@cursor.com>

CMakeLists.txt

@@ -105,6 +105,8 @@ set(CJSON_DIR "${CMAKE_CURRENT_SOURCE_DIR}/vendor/cjson")
 
 set(CST_CORE_SOURCES
   vendor/cjson/cJSON.c
+  vendor/monocypher/monocypher.c
+  vendor/monocypher/monocypher-ed25519.c
   src/util.c
   src/ctl_parse.c
   src/os_compat.c
@@ -119,6 +121,7 @@ set(CST_CORE_SOURCES
   src/subagent.c
   src/runtime.c
   src/worktree.c
+  src/realm.c
   src/attach.c
   src/clipboard.c
   src/pdf_text.c
@@ -218,7 +221,12 @@ target_include_directories(cstcore PUBLIC
   "${CMAKE_CURRENT_SOURCE_DIR}/include"
   "${SD_DIR}/include"
   "${CJSON_DIR}"
+  "${CMAKE_CURRENT_SOURCE_DIR}/vendor/monocypher"
 )
+set_source_files_properties(
+  vendor/monocypher/monocypher.c
+  vendor/monocypher/monocypher-ed25519.c
+  PROPERTIES COMPILE_OPTIONS "-w")
 target_compile_definitions(cstcore PRIVATE _GNU_SOURCE)
 if(WIN32)
   target_compile_definitions(cstcore PRIVATE _WIN32_WINNT=0x0A00)
@@ -378,7 +386,7 @@ set(_CST_CORE_TESTS test_llm_body test_prefix_stable test_sse_decode
     test_shell test_diff test_tools_fs test_tools_ext test_registry
     test_undo test_config test_models test_model_registry test_sandbox
     test_keymap test_shell_compact test_skills
-    test_plugins test_mcp test_subagent test_runtime test_lowil
+    test_plugins test_mcp test_subagent test_runtime test_realm test_lowil
     test_win_utf8 test_os_dir test_tmpdir
     test_tool_meta test_embed)
 if(CST_BUILD_WEBUI)