feat(cli): M-Tool 1-3 — CLI, templates, Gitea publishing pipeline

Phase B complete: Shade now has a full developer tooling story.

@shade/cli
- shade init with project scaffolding from templates
- shade fingerprint (own or peer)
- shade publish (re-upload bundle)
- shade rotate (--identity for full rotation, otherwise signed prekey)
- shade peer add/list/verify/remove
- shade dashboard (opens observer in browser)
- shade doctor (diagnose config, storage, prekey server reachability)
- Config from .shaderc.json or SHADE_* env vars

Templates (in packages/shade-cli/templates/)
- bun-server — Bun + Hono backend with /send + /receive endpoints
- chat-demo — Two-process Alice/Bob chat over HTTP

Publishing pipeline (Gitea npm registry)
- .gitea/workflows/test.yml — CI on push/PR with PostgreSQL service
- .gitea/workflows/publish.yml — publish on git tag v*
- scripts/publish-all.ts — local publish helper with DRY_RUN support
- scripts/bump-version.ts — lockstep version bump across all packages
- Root package.json scripts: version, publish:dry, publish:all

Also: /health endpoint now lives in createPrekeyRoutes so doctor can
probe it without needing the full standalone setup.

Dry-run verified: all 11 packages pack cleanly.
246 tests passing, 0 failures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/shade-cli/templates/bun-server/README.md

@@ -0,0 +1,46 @@
+# __PROJECT_NAME__
+
+A Shade-enabled Bun + Hono server. Encrypted messages in/out via two HTTP endpoints.
+
+## Prerequisites
+
+A running Shade prekey server. The default is `__PREKEY_SERVER__`. You can either:
+- Run one locally: `docker run -p 3900:3900 shade-prekey-server`
+- Override with `SHADE_PREKEY_SERVER=...` in `.env`
+
+## Run
+
+```bash
+bun install
+bun run start
+```
+
+The server registers itself with the prekey server on startup.
+
+## Endpoints
+
+### Send an encrypted message
+
+```bash
+curl -X POST http://localhost:3000/send \
+  -H "Content-Type: application/json" \
+  -d '{"to": "peer-name", "message": "hello"}'
+```
+
+Returns a `ShadeEnvelope` you can forward to the peer via any transport.
+
+### Receive an encrypted envelope
+
+```bash
+curl -X POST http://localhost:3000/receive \
+  -H "Content-Type: application/json" \
+  -d '{"from": "peer-name", "envelope": {...}}'
+```
+
+Returns the decrypted plaintext.
+
+## Next steps
+
+- Wire a real delivery layer (WebSocket, HTTP push, etc.)
+- Run `shade dashboard` to watch live activity
+- Compare fingerprints with peers out-of-band before trusting sessions