feat(cli): M-Tool 1-3 — CLI, templates, Gitea publishing pipeline

Phase B complete: Shade now has a full developer tooling story.

@shade/cli
- shade init with project scaffolding from templates
- shade fingerprint (own or peer)
- shade publish (re-upload bundle)
- shade rotate (--identity for full rotation, otherwise signed prekey)
- shade peer add/list/verify/remove
- shade dashboard (opens observer in browser)
- shade doctor (diagnose config, storage, prekey server reachability)
- Config from .shaderc.json or SHADE_* env vars

Templates (in packages/shade-cli/templates/)
- bun-server — Bun + Hono backend with /send + /receive endpoints
- chat-demo — Two-process Alice/Bob chat over HTTP

Publishing pipeline (Gitea npm registry)
- .gitea/workflows/test.yml — CI on push/PR with PostgreSQL service
- .gitea/workflows/publish.yml — publish on git tag v*
- scripts/publish-all.ts — local publish helper with DRY_RUN support
- scripts/bump-version.ts — lockstep version bump across all packages
- Root package.json scripts: version, publish:dry, publish:all

Also: /health endpoint now lives in createPrekeyRoutes so doctor can
probe it without needing the full standalone setup.

Dry-run verified: all 11 packages pack cleanly.
246 tests passing, 0 failures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/shade-cli/templates/chat-demo/README.md

@@ -0,0 +1,17 @@
+# __PROJECT_NAME__
+
+Two-process chat demo: Alice and Bob talk via the Shade SDK over a simple
+HTTP relay. Shows how easy it is to add E2EE to any transport.
+
+## Run
+
+Start a prekey server first (e.g. `docker run -p 3900:3900 shade-prekey-server`).
+
+Then in two terminals:
+
+```bash
+bun run bob     # starts Bob's process on :4001
+bun run alice   # starts Alice's process on :4000
+```
+
+Alice will send a message to Bob; both will print the activity.

packages/shade-cli/templates/chat-demo/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "__PROJECT_NAME__",
+  "version": "0.0.1",
+  "type": "module",
+  "scripts": {
+    "alice": "bun run src/alice.ts",
+    "bob": "bun run src/bob.ts"
+  },
+  "dependencies": {
+    "@shade/sdk": "^0.1.0"
+  }
+}

packages/shade-cli/templates/chat-demo/src/alice.ts

@@ -0,0 +1,27 @@
+import { createShade } from '@shade/sdk';
+
+const alice = await createShade({
+  prekeyServer: '__PREKEY_SERVER__',
+  storage: 'sqlite:./.shade/alice.db',
+  address: 'alice',
+});
+
+console.log(`Alice ready. Fingerprint: ${await alice.fingerprint}`);
+
+// Send a message to Bob
+const envelope = await alice.send('bob', 'Hey Bob, this is encrypted!');
+
+// Forward to Bob's process (simple HTTP)
+const res = await fetch('http://localhost:4001/receive', {
+  method: 'POST',
+  headers: { 'Content-Type': 'application/json' },
+  body: JSON.stringify({ from: 'alice', envelope }),
+});
+
+if (res.ok) {
+  console.log('✓ Message delivered');
+} else {
+  console.error('Failed to deliver:', await res.text());
+}
+
+await alice.shutdown();

packages/shade-cli/templates/chat-demo/src/bob.ts

@@ -0,0 +1,24 @@
+import { Hono } from 'hono';
+import { createShade } from '@shade/sdk';
+
+const bob = await createShade({
+  prekeyServer: '__PREKEY_SERVER__',
+  storage: 'sqlite:./.shade/bob.db',
+  address: 'bob',
+});
+
+console.log(`Bob ready. Fingerprint: ${await bob.fingerprint}`);
+
+bob.onMessage((from, msg) => {
+  console.log(`\n📨 [${from}] ${msg}\n`);
+});
+
+const app = new Hono();
+app.post('/receive', async (c) => {
+  const { from, envelope } = await c.req.json();
+  await bob.receive(from, envelope);
+  return c.json({ ok: true });
+});
+
+export default { port: 4001, fetch: app.fetch };
+console.log('Bob listening on :4001');