feat(cli): M-Tool 1-3 — CLI, templates, Gitea publishing pipeline

Phase B complete: Shade now has a full developer tooling story.

@shade/cli
- shade init with project scaffolding from templates
- shade fingerprint (own or peer)
- shade publish (re-upload bundle)
- shade rotate (--identity for full rotation, otherwise signed prekey)
- shade peer add/list/verify/remove
- shade dashboard (opens observer in browser)
- shade doctor (diagnose config, storage, prekey server reachability)
- Config from .shaderc.json or SHADE_* env vars

Templates (in packages/shade-cli/templates/)
- bun-server — Bun + Hono backend with /send + /receive endpoints
- chat-demo — Two-process Alice/Bob chat over HTTP

Publishing pipeline (Gitea npm registry)
- .gitea/workflows/test.yml — CI on push/PR with PostgreSQL service
- .gitea/workflows/publish.yml — publish on git tag v*
- scripts/publish-all.ts — local publish helper with DRY_RUN support
- scripts/bump-version.ts — lockstep version bump across all packages
- Root package.json scripts: version, publish:dry, publish:all

Also: /health endpoint now lives in createPrekeyRoutes so doctor can
probe it without needing the full standalone setup.

Dry-run verified: all 11 packages pack cleanly.
246 tests passing, 0 failures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/shade-cli/src/config.ts

@@ -0,0 +1,50 @@
+import { existsSync, readFileSync } from 'fs';
+import { join } from 'path';
+
+export interface CliConfig {
+  prekeyServer: string;
+  storage: string;
+  observerToken?: string;
+  observerUrl?: string;
+  address?: string;
+}
+
+const DEFAULT_STORAGE = 'sqlite:./.shade/client.db';
+
+/** Read config from .shaderc.json in cwd, then env vars as fallback */
+export function loadConfig(cwd: string = process.cwd()): CliConfig {
+  const configPath = join(cwd, '.shaderc.json');
+  let fileConfig: Partial<CliConfig> = {};
+
+  if (existsSync(configPath)) {
+    try {
+      fileConfig = JSON.parse(readFileSync(configPath, 'utf-8'));
+    } catch (err) {
+      throw new Error(`Failed to parse .shaderc.json: ${(err as Error).message}`);
+    }
+  }
+
+  const prekeyServer = fileConfig.prekeyServer ?? process.env.SHADE_PREKEY_SERVER;
+  if (!prekeyServer) {
+    throw new Error(
+      'Missing prekeyServer. Set it in .shaderc.json or via SHADE_PREKEY_SERVER env var.',
+    );
+  }
+
+  return {
+    prekeyServer,
+    storage: fileConfig.storage ?? process.env.SHADE_DB_PATH ?? DEFAULT_STORAGE,
+    observerToken: fileConfig.observerToken ?? process.env.SHADE_OBSERVER_TOKEN,
+    observerUrl: fileConfig.observerUrl ?? process.env.SHADE_OBSERVER_URL,
+    address: fileConfig.address ?? process.env.SHADE_ADDRESS,
+  };
+}
+
+/** Check config is loadable without throwing; for `shade doctor`. */
+export function tryLoadConfig(cwd: string = process.cwd()): { ok: true; config: CliConfig } | { ok: false; error: string } {
+  try {
+    return { ok: true, config: loadConfig(cwd) };
+  } catch (err) {
+    return { ok: false, error: (err as Error).message };
+  }
+}