feat(cli): M-Tool 1-3 — CLI, templates, Gitea publishing pipeline

Phase B complete: Shade now has a full developer tooling story.

@shade/cli
- shade init with project scaffolding from templates
- shade fingerprint (own or peer)
- shade publish (re-upload bundle)
- shade rotate (--identity for full rotation, otherwise signed prekey)
- shade peer add/list/verify/remove
- shade dashboard (opens observer in browser)
- shade doctor (diagnose config, storage, prekey server reachability)
- Config from .shaderc.json or SHADE_* env vars

Templates (in packages/shade-cli/templates/)
- bun-server — Bun + Hono backend with /send + /receive endpoints
- chat-demo — Two-process Alice/Bob chat over HTTP

Publishing pipeline (Gitea npm registry)
- .gitea/workflows/test.yml — CI on push/PR with PostgreSQL service
- .gitea/workflows/publish.yml — publish on git tag v*
- scripts/publish-all.ts — local publish helper with DRY_RUN support
- scripts/bump-version.ts — lockstep version bump across all packages
- Root package.json scripts: version, publish:dry, publish:all

Also: /health endpoint now lives in createPrekeyRoutes so doctor can
probe it without needing the full standalone setup.

Dry-run verified: all 11 packages pack cleanly.
246 tests passing, 0 failures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/shade-cli/templates/bun-server/src/index.ts

@@ -0,0 +1,46 @@
+import { Hono } from 'hono';
+import { createShade } from '@shade/sdk';
+
+/**
+ * __PROJECT_NAME__ — Shade-enabled Bun server template.
+ *
+ * Exposes two endpoints:
+ *   POST /send     — encrypt a message to a peer
+ *   POST /receive  — decrypt an incoming envelope
+ */
+
+const shade = await createShade({
+  prekeyServer: process.env.SHADE_PREKEY_SERVER ?? '__PREKEY_SERVER__',
+  storage: process.env.SHADE_DB_PATH ?? 'sqlite:./.shade/client.db',
+  address: '__PROJECT_NAME__',
+});
+
+console.log(`Shade initialized as ${shade.myAddress}`);
+console.log(`Fingerprint: ${await shade.fingerprint}`);
+
+shade.onMessage((from, msg) => {
+  console.log(`[${from}] ${msg}`);
+});
+
+const app = new Hono();
+
+app.get('/', (c) => c.text(`__PROJECT_NAME__ — Shade-enabled backend`));
+
+app.post('/send', async (c) => {
+  const { to, message } = await c.req.json();
+  const envelope = await shade.send(to, message);
+  return c.json({ envelope });
+});
+
+app.post('/receive', async (c) => {
+  const { from, envelope } = await c.req.json();
+  const plaintext = await shade.receive(from, envelope);
+  return c.json({ plaintext });
+});
+
+export default {
+  port: Number(process.env.PORT ?? 3000),
+  fetch: app.fetch,
+};
+
+console.log(`Server listening on :${process.env.PORT ?? 3000}`);