feat(cli): M-Tool 1-3 — CLI, templates, Gitea publishing pipeline

Phase B complete: Shade now has a full developer tooling story.

@shade/cli
- shade init with project scaffolding from templates
- shade fingerprint (own or peer)
- shade publish (re-upload bundle)
- shade rotate (--identity for full rotation, otherwise signed prekey)
- shade peer add/list/verify/remove
- shade dashboard (opens observer in browser)
- shade doctor (diagnose config, storage, prekey server reachability)
- Config from .shaderc.json or SHADE_* env vars

Templates (in packages/shade-cli/templates/)
- bun-server — Bun + Hono backend with /send + /receive endpoints
- chat-demo — Two-process Alice/Bob chat over HTTP

Publishing pipeline (Gitea npm registry)
- .gitea/workflows/test.yml — CI on push/PR with PostgreSQL service
- .gitea/workflows/publish.yml — publish on git tag v*
- scripts/publish-all.ts — local publish helper with DRY_RUN support
- scripts/bump-version.ts — lockstep version bump across all packages
- Root package.json scripts: version, publish:dry, publish:all

Also: /health endpoint now lives in createPrekeyRoutes so doctor can
probe it without needing the full standalone setup.

Dry-run verified: all 11 packages pack cleanly.
246 tests passing, 0 failures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/shade-cli/templates/chat-demo/src/alice.ts

@@ -0,0 +1,27 @@
+import { createShade } from '@shade/sdk';
+
+const alice = await createShade({
+  prekeyServer: '__PREKEY_SERVER__',
+  storage: 'sqlite:./.shade/alice.db',
+  address: 'alice',
+});
+
+console.log(`Alice ready. Fingerprint: ${await alice.fingerprint}`);
+
+// Send a message to Bob
+const envelope = await alice.send('bob', 'Hey Bob, this is encrypted!');
+
+// Forward to Bob's process (simple HTTP)
+const res = await fetch('http://localhost:4001/receive', {
+  method: 'POST',
+  headers: { 'Content-Type': 'application/json' },
+  body: JSON.stringify({ from: 'alice', envelope }),
+});
+
+if (res.ok) {
+  console.log('✓ Message delivered');
+} else {
+  console.error('Failed to deliver:', await res.text());
+}
+
+await alice.shutdown();