feat(pqc): add quantum-readiness audit plugin

[Taas-ai]

Summary

Adds a pqc plugin that provides post-quantum cryptography readiness assessment for managed Hiero accounts.

Closes #1690

What This PR Does

Introduces three new commands:

Command	Description
hcli pqc audit [--account] [--network]	Scan managed accounts for quantum-vulnerable key types (ED25519, ECDSA)
hcli pqc score --account 0.0.123456	Calculate detailed Quantum Readiness Score with breakdown
hcli pqc report [--format json|csv|human]	Generate compliance reports in multiple formats

Key Features

• 5-tier vulnerability classification based on NIST SP 800-131A Rev 3: PQC_READY (0) → CRITICAL (4)
• Quantum Readiness Score (QRS): Composite 0-100 score factoring key vulnerability (40%), algorithm diversity (20%), rotation readiness (20%), and CNSA 2.0 compliance alignment (20%)
• Compliance flags: CNSA 2.0 (2027 deadline), NIST FIPS 203 (ML-KEM), NIST FIPS 204 (ML-DSA)
• Multiple output formats: JSON (machine-readable), CSV (CRM/spreadsheet import), human-readable with Handlebars templates

Why Now

• NIST finalized PQC standards (FIPS 203/204/205) in August 2024
• NSA CNSA 2.0 mandates PQC adoption by 2027
• Every key in Hiero today (ED25519, ECDSA-secp256k1) is broken by Shor's algorithm
• "Harvest now, decrypt later" attacks make assessment urgent even before PQC key support exists
• No existing HIP or tooling addresses PQC readiness in the Hiero ecosystem

Plugin Architecture

Follows the standard hiero-cli plugin structure:

src/plugins/pqc/
├── manifest.ts              # 3 CommandSpec entries
├── index.ts                 # Barrel exports
├── types.ts                 # VulnerabilityTier enum, QRS weights, interfaces
├── utils.ts                 # Scoring engine, algorithm classification
├── commands/
│   ├── audit/               # handler.ts, input.ts, output.ts, index.ts
│   ├── score/               # handler.ts, input.ts, output.ts, index.ts
│   └── report/              # handler.ts, input.ts, output.ts, index.ts
└── __tests__/unit/
    └── audit.test.ts        # 14 unit tests for utils

Testing

14 unit tests covering:

• Algorithm classification (ED25519, ECDSA, ML-DSA, ML-KEM, unknown algorithms)
• Key detection by byte length (32, 33, 65 bytes)
• QRS calculation (empty keys, all-critical, with/without admin, PQC-ready, bounds)
• Recommendation generation (critical keys, missing admin, rotation possible)

Related Work

• A companion HIP (Hiero Improvement Proposal) is being prepared to formalize the PQC readiness framework
• Hiero TSC Issue Support local network for CLI tool - Closes #192 #220 — Migrate Hedera-Cryptography Repo
• hiero-sdk-js Issue #3054 — Noble Migration (precursor to PQC support)
• Consensus Node Issue #17294 — Future cryptography key needs

Checklist

• Follows plugin architecture from PLUGIN_ARCHITECTURE_GUIDE.md
• Zod schemas for all inputs and outputs
• Handlebars templates for human-readable output
• Unit tests for core utilities
• Conventional commit format
• DCO sign-off
• No breaking changes to existing functionality