feat(observer): M-Obs 1-3 — event bus, server hooks, observer backend

M-Obs 1: Event bus in @shade/core
- ShadeEventEmitter with typed event union, ring buffer for replay
- 12 event types covering session lifecycle, ratchet operations,
  prekey changes, identity rotation, trust changes
- Wired into ShadeSessionManager (zero overhead when not enabled)
- shortHash helper for safe display of public keys
- Security test: regex-checks event payloads contain no key material

M-Obs 2: Prekey server event hooks
- PrekeyServerEvents emitter mirroring core's pattern
- 5 server event types: registered, fetched, replenished, deleted, rate_limited
- Wired into all routes including the rate-limit error handler
- shortHash helper using crypto.subtle directly (no provider dep)

M-Obs 3: @shade/observer package
- StateAggregator subscribes to client + server events, builds rolling snapshot
- Hono routes: GET /api/state (snapshot), GET /api/events (SSE stream)
- Bearer token auth via SHADE_OBSERVER_TOKEN, query string for SSE
- Refuses to start with token < 16 chars (ConfigurationError)
- Static file serving for bundled dashboard at /dashboard/
- Placeholder dashboard renders when no built SPA present

220 tests passing, 0 failures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bun.lock

@@ -28,6 +28,18 @@
         "@shade/core": "workspace:*",
       },
     },
+    "packages/shade-observer": {
+      "name": "@shade/observer",
+      "version": "0.1.0",
+      "dependencies": {
+        "@shade/core": "workspace:*",
+        "@shade/server": "workspace:*",
+        "hono": "^4.12.12",
+      },
+      "devDependencies": {
+        "@shade/crypto-web": "workspace:*",
+      },
+    },
     "packages/shade-proto": {
       "name": "@shade/proto",
       "version": "0.1.0",
@@ -88,6 +100,8 @@
 
     "@shade/crypto-web": ["@shade/crypto-web@workspace:packages/shade-crypto-web"],
 
+    "@shade/observer": ["@shade/observer@workspace:packages/shade-observer"],
+
     "@shade/proto": ["@shade/proto@workspace:packages/shade-proto"],
 
     "@shade/server": ["@shade/server@workspace:packages/shade-server"],