feat: password Realm, single-chair login, shared parliament context (0.9.12)

Derive Realm keys from a user password (Argon2id, no private key on disk).
Login claims the sole chair with handover; peers share parliament context;
--new-project clears it. CLI peer/discover helpers and Docker alpine recipe
included; headless empty-answer retries raised for unattended runs.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/test_parliament.c

@@ -0,0 +1,58 @@
+#define _POSIX_C_SOURCE 200809L
+#include "cst_parliament.h"
+#include "cst_realm.h"
+#include "cst_test_util.h"
+#include "os_compat.h"
+
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+int main(void) {
+  char dir[2048], cfg[512];
+  assert(!test_tmpdir(dir, sizeof(dir), "parliament"));
+  assert(snprintf(cfg, sizeof(cfg), "%s/cfg", dir) < (int)sizeof(cfg));
+  assert(!os_mkdir_p(cfg, 0700));
+  setenv("XDG_CONFIG_HOME", cfg, 1);
+
+  char realm[OS_PATH_MAX];
+  assert(cst_realm_dir(realm, sizeof(realm)) == 0);
+  assert(cst_realm_init_password(realm, "correct horse battery") == 0);
+  assert(cst_realm_is_password_mode(realm));
+
+  cst_realm_keys_t bad, good;
+  assert(cst_realm_unlock_password(realm, "wrong", &bad) != 0);
+  assert(cst_realm_unlock_password(realm, "correct horse battery", &good) == 0);
+
+  char err[128];
+  char *hand = cst_parliament_login("correct horse battery", "phone-1", "pixel",
+                                    err, sizeof(err));
+  assert(hand && strstr(hand, "LOGIN_OK") && strstr(hand, "chair=phone-1"));
+  free(hand);
+
+  cst_parliament_meta_t m;
+  assert(cst_parliament_load(&m) == 0);
+  assert(!strcmp(m.chair_instance, "phone-1"));
+
+  assert(cst_parliament_context_put("shared agenda v1") == 0);
+  hand = cst_parliament_login("correct horse battery", "laptop-2", "thinkpad",
+                              err, sizeof(err));
+  assert(hand && strstr(hand, "handover_from=phone-1"));
+  assert(strstr(hand, "shared agenda v1"));
+  free(hand);
+  assert(cst_parliament_load(&m) == 0);
+  assert(!strcmp(m.chair_instance, "laptop-2"));
+
+  assert(cst_parliament_new_project("proj-b") == 0);
+  char *ctx = cst_parliament_context_get();
+  assert(ctx && ctx[0] == 0);
+  free(ctx);
+  assert(cst_parliament_load(&m) == 0);
+  assert(!strcmp(m.project_id, "proj-b"));
+  assert(m.chair_instance[0] == 0);
+
+  test_rmrf(dir);
+  puts("test_parliament: OK");
+  return 0;
+}