feat(cli): M-Tool 1-3 — CLI, templates, Gitea publishing pipeline

Phase B complete: Shade now has a full developer tooling story.

@shade/cli
- shade init with project scaffolding from templates
- shade fingerprint (own or peer)
- shade publish (re-upload bundle)
- shade rotate (--identity for full rotation, otherwise signed prekey)
- shade peer add/list/verify/remove
- shade dashboard (opens observer in browser)
- shade doctor (diagnose config, storage, prekey server reachability)
- Config from .shaderc.json or SHADE_* env vars

Templates (in packages/shade-cli/templates/)
- bun-server — Bun + Hono backend with /send + /receive endpoints
- chat-demo — Two-process Alice/Bob chat over HTTP

Publishing pipeline (Gitea npm registry)
- .gitea/workflows/test.yml — CI on push/PR with PostgreSQL service
- .gitea/workflows/publish.yml — publish on git tag v*
- scripts/publish-all.ts — local publish helper with DRY_RUN support
- scripts/bump-version.ts — lockstep version bump across all packages
- Root package.json scripts: version, publish:dry, publish:all

Also: /health endpoint now lives in createPrekeyRoutes so doctor can
probe it without needing the full standalone setup.

Dry-run verified: all 11 packages pack cleanly.
246 tests passing, 0 failures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

README.md

@@ -17,30 +17,65 @@ End-to-end encryption library implementing the Signal Protocol (X3DH + Double Ra
 
 ## Quick start
 
+Add the Gitea npm registry to your project's `.npmrc`:
+
+```
+@shade:registry=https://gt.zyon.no/api/packages/Stian/npm/
+```
+
+Then install the SDK (one-liner for most use cases):
+
+```bash
+bun add @shade/sdk
+```
+
+Or install specific packages if you need fine-grained control:
+
 ```bash
-# In your project
 bun add @shade/core @shade/crypto-web @shade/storage-sqlite
 ```
 
+Even faster — scaffold a new project with the CLI:
+
+```bash
+bun add -g @shade/cli
+shade init my-app --template bun-server
+cd my-app && bun install && bun run start
+```
+
+Magic one-liner with the SDK:
+
+```ts
+import { createShade } from '@shade/sdk';
+
+const shade = await createShade({
+  prekeyServer: 'https://shade.example.com',
+  storage: 'sqlite:/data/shade.db',
+  address: 'alice@example.com',
+});
+
+// Send (auto-establishes session if none exists)
+const envelope = await shade.send('bob@example.com', 'Hello, encrypted world!');
+
+// Receive
+const plaintext = await shade.receive('alice@example.com', incomingEnvelope);
+
+// Your safety number for out-of-band verification
+console.log(await shade.fingerprint);
+```
+
+Or use the lower-level packages directly if you need full control:
+
 ```ts
 import { ShadeSessionManager } from '@shade/core';
 import { SubtleCryptoProvider } from '@shade/crypto-web';
 import { SQLiteStorage } from '@shade/storage-sqlite';
 
-const crypto = new SubtleCryptoProvider();
-const storage = new SQLiteStorage('/data/shade-client.db');
-
-const manager = new ShadeSessionManager(crypto, storage);
+const manager = new ShadeSessionManager(
+  new SubtleCryptoProvider(),
+  new SQLiteStorage('/data/shade.db'),
+);
 await manager.initialize();
-
-// Establish a session with a peer (after fetching their bundle)
-await manager.initSessionFromBundle('bob', bobBundle);
-
-// Encrypt
-const envelope = await manager.encrypt('bob', 'Hello, encrypted world!');
-
-// Decrypt
-const plaintext = await manager.decrypt('alice', incomingEnvelope);
 ```
 
 ## Architecture
@@ -79,6 +114,25 @@ const plaintext = await manager.decrypt('alice', incomingEnvelope);
 | `@shade/observer` | Live debugger backend (snapshot, SSE, dashboard) — see [README](./packages/shade-observer/README.md) |
 | `@shade/widgets` | Embeddable React widgets — see [README](./packages/shade-widgets/README.md) |
 | `@shade/dashboard` | Standalone dashboard SPA bundled into the observer |
+| `@shade/sdk` | High-level wrapper with `createShade()` one-liner, auto-publish, auto-establish, auto-replenish |
+| `@shade/cli` | `shade init` scaffolder + utilities (fingerprint, rotate, peer, dashboard, doctor) |
+
+## Publishing
+
+All packages publish to a self-hosted Gitea npm registry on `gt.zyon.no`.
+
+```bash
+# Bump all packages in lockstep
+bun run version 1.1.0
+
+# Dry-run (pack all tarballs without publishing)
+bun run publish:dry
+
+# Real publish (requires GITEA_TOKEN env var)
+bun run publish:all
+
+# Or via CI: push a git tag v1.1.0 and .gitea/workflows/publish.yml runs
+```
 
 ## Security properties