feat(wire): E2E PAKE handshake with X25519 ECDH + AES-256-GCM

[blaspat]

Summary

Adds forward-secret end-to-end encryption between the Go node client and the Python plugin server. The pairing token is never transmitted on the wire after initial pairing — only HMAC proofs are exchanged during the auth handshake.

Changes

• internal/wire/e2e.go (new) — X25519 keygen, ECDH, HKDF-SHA256 key derivation, HMAC mutual auth proofs, AES-256-GCM encrypt/decrypt
• internal/wire/messages.go — Add E2E, ECDHPub, Proof, Salt fields to handshake message structs; add Enc wire type
• internal/wire/client.go — E2E handshake in Dial: ECDH exchange in hello/hello_ack, proof verification in auth/auth_ok, session key derivation. WriteE2E/ReadE2E wrappers for all post-handshake messages
• internal/wire/dispatch.go — Delegate to WriteE2E/ReadE2E after handshake; legacy plaintext fallback for servers without E2E
• README.md — Document E2E encryption section with handshake flow, security properties, and backward compatibility
• .gitignore — Ignore built binary

Handshake

Client                                    Server
  │  hello { e2e: true, ecdh_pub }        │
  │  hello_ack { ecdh_pub, salt }         │
  │  auth { proof: HMAC(handshake_key) }  │
  │  auth_ok { proof: HMAC(handshake_key) }│
  │  ─── AES-256-GCM ACTIVE ───

Security properties

Property	How
Token never on wire	Token mixed into HKDF; auth carries only HMAC proof
Forward secrecy	Ephemeral X25519 keys per session, discarded on disconnect
MITM resistance	Without token, attacker can't forge HMAC proof → 4001
Replay immunity	New ephemeral keys per session

Backward compatibility

Client sends e2e: true in hello. Server without E2E support omits ecdh_pub → client falls back to legacy plaintext auth.

Closes #58