feat: password Realm, single-chair login, shared parliament context (0.9.12)

Derive Realm keys from a user password (Argon2id, no private key on disk).
Login claims the sole chair with handover; peers share parliament context;
--new-project clears it. CLI peer/discover helpers and Docker alpine recipe
included; headless empty-answer retries raised for unattended runs.

Co-authored-by: Cursor <cursoragent@cursor.com>

include/cst_parliament_cli.h

@@ -0,0 +1,26 @@
+#ifndef CST_PARLIAMENT_CLI_H
+#define CST_PARLIAMENT_CLI_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Standalone parliament/Realm ops for Docker and unattended smoke tests.
+ * Returns a process exit code (0 = success). */
+int cst_parliament_cli_realm_new(void);
+int cst_parliament_cli_realm_password_init(const char *password);
+int cst_parliament_cli_login(const char *password, const char *instance_id,
+                             const char *device_label);
+int cst_parliament_cli_new_project(const char *project_id);
+int cst_parliament_cli_realm_enroll(const char *instance_id, const char *label);
+int cst_parliament_cli_peer_listen(int port, const char *instance_id);
+int cst_parliament_cli_peer_dial(const char *host, int port,
+                                 const char *instance_id);
+int cst_parliament_cli_discover(const char *instance_id, int peer_port,
+                                int wait_ms);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif