feat: password Realm, single-chair login, shared parliament context (0.9.12)

Derive Realm keys from a user password (Argon2id, no private key on disk).
Login claims the sole chair with handover; peers share parliament context;
--new-project clears it. CLI peer/discover helpers and Docker alpine recipe
included; headless empty-answer retries raised for unattended runs.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/Dockerfile.parliament

@@ -0,0 +1,14 @@
+# Build inside Alpine so the binary does not depend on the host Nix store.
+FROM alpine:latest AS build
+RUN apk add --no-cache build-base curl-dev ncurses-dev pkgconf python3
+WORKDIR /src
+COPY . .
+# Skip WebUI asset embedding quirks in minimal images if needed; keep default on.
+RUN make -j"$(nproc)" cst-agent
+
+FROM alpine:latest
+RUN apk add --no-cache libcurl ncurses-libs ca-certificates
+COPY --from=build /src/cst-agent /usr/local/bin/cst-agent
+ENV XDG_CONFIG_HOME=/realm-config
+WORKDIR /work
+ENTRYPOINT ["cst-agent"]