feat(cli): M-Tool 1-3 — CLI, templates, Gitea publishing pipeline

Phase B complete: Shade now has a full developer tooling story.

@shade/cli
- shade init with project scaffolding from templates
- shade fingerprint (own or peer)
- shade publish (re-upload bundle)
- shade rotate (--identity for full rotation, otherwise signed prekey)
- shade peer add/list/verify/remove
- shade dashboard (opens observer in browser)
- shade doctor (diagnose config, storage, prekey server reachability)
- Config from .shaderc.json or SHADE_* env vars

Templates (in packages/shade-cli/templates/)
- bun-server — Bun + Hono backend with /send + /receive endpoints
- chat-demo — Two-process Alice/Bob chat over HTTP

Publishing pipeline (Gitea npm registry)
- .gitea/workflows/test.yml — CI on push/PR with PostgreSQL service
- .gitea/workflows/publish.yml — publish on git tag v*
- scripts/publish-all.ts — local publish helper with DRY_RUN support
- scripts/bump-version.ts — lockstep version bump across all packages
- Root package.json scripts: version, publish:dry, publish:all

Also: /health endpoint now lives in createPrekeyRoutes so doctor can
probe it without needing the full standalone setup.

Dry-run verified: all 11 packages pack cleanly.
246 tests passing, 0 failures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/publish-all.ts

@@ -0,0 +1,99 @@
+#!/usr/bin/env bun
+/**
+ * Publish all @shade/* packages to the Gitea npm registry.
+ *
+ * Expects these env vars:
+ *   GITEA_TOKEN  — publish token from Gitea (Settings → Applications)
+ *   GITEA_USER   — Gitea username that owns the registry (e.g. "Stian")
+ *
+ * Optional:
+ *   DRY_RUN=1    — build tarballs but don't publish
+ *
+ * Usage:
+ *   bun run scripts/publish-all.ts
+ */
+import { readFileSync, writeFileSync, existsSync } from 'fs';
+import { join } from 'path';
+import { $ } from 'bun';
+
+const PACKAGES = [
+  'shade-core',
+  'shade-crypto-web',
+  'shade-proto',
+  'shade-storage-sqlite',
+  'shade-storage-postgres',
+  'shade-server',
+  'shade-observer',
+  'shade-transport',
+  'shade-widgets',
+  'shade-sdk',
+  'shade-cli',
+];
+
+const REGISTRY_HOST = 'gt.zyon.no';
+const ROOT = join(import.meta.dir, '..');
+
+async function main() {
+  const token = process.env.GITEA_TOKEN;
+  const user = process.env.GITEA_USER ?? 'Stian';
+  const dryRun = process.env.DRY_RUN === '1';
+
+  if (!token && !dryRun) {
+    console.error('GITEA_TOKEN is required (or set DRY_RUN=1)');
+    process.exit(1);
+  }
+
+  const registryUrl = `https://${REGISTRY_HOST}/api/packages/${user}/npm/`;
+  console.log(`Target registry: ${registryUrl}`);
+  console.log(`Dry run: ${dryRun ? 'yes' : 'no'}`);
+  console.log();
+
+  // Write a temporary .npmrc at the root
+  const npmrcPath = join(ROOT, '.npmrc.publish');
+  const npmrc = [
+    `@shade:registry=${registryUrl}`,
+    dryRun ? '' : `//${REGISTRY_HOST}/api/packages/${user}/npm/:_authToken=${token}`,
+  ].filter(Boolean).join('\n');
+  writeFileSync(npmrcPath, npmrc);
+
+  let published = 0;
+  let skipped = 0;
+
+  for (const pkg of PACKAGES) {
+    const pkgDir = join(ROOT, 'packages', pkg);
+    if (!existsSync(join(pkgDir, 'package.json'))) {
+      console.log(`⊘ ${pkg} — package.json not found, skipping`);
+      skipped++;
+      continue;
+    }
+
+    const pkgJson = JSON.parse(readFileSync(join(pkgDir, 'package.json'), 'utf-8'));
+    console.log(`→ ${pkgJson.name}@${pkgJson.version}`);
+
+    try {
+      if (dryRun) {
+        await $`cd ${pkgDir} && bun pm pack --dry-run`.quiet();
+      } else {
+        await $`cd ${pkgDir} && npm publish --registry=${registryUrl} --userconfig ${npmrcPath}`.quiet();
+      }
+      published++;
+      console.log(`  ✓ ${dryRun ? 'packed' : 'published'}`);
+    } catch (err) {
+      console.error(`  ✗ failed: ${(err as Error).message}`);
+      process.exitCode = 1;
+    }
+  }
+
+  // Clean up temp npmrc
+  try {
+    await $`rm ${npmrcPath}`.quiet();
+  } catch {}
+
+  console.log();
+  console.log(`Done: ${published} published, ${skipped} skipped`);
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});