Add paired gRPC client-server mode - #30

What this changes

Adds a native, session-aware gRPC client/server mode alongside the existing stateless OpenAI-compatible HTTP API.

• Adds fingerprint verification, Ed25519 client identities, one-time pairing approval, and issued client certificates over mTLS
• Adds paired-device listing, approval, denial, and revocation
• Adds remote TUI, prompt, session, history, usage, compaction, reasoning, tool event, approval, and cancellation support
• Adds a bidirectional streaming chat API while keeping HTTP and gRPC authentication separate
• Adds rate limits, payload and concurrency bounds, certificate validation, migrations, and pairing/streaming tests
• Makes setup choose between server configuration and client pairing before continuing
• Documents the gRPC architecture, pairing flow, storage locations, and operational commands

How it was verified

• make test-race passes
• New behaviour has a test, or there is nothing to test
• Local build passes
• Linux arm64 cross-build passes
• Darwin arm64 cross-build passes

Checklist

• Follows docs/CONVENTION.md: no comments, no :=, one var block per function in first-use order with err last, callees before callers, and main unconditionally last
• New .go files carry the two-line SPDX header
• Documentation updated if behaviour a user can see has changed
• My contribution is licensed GPL-3.0-or-later, matching the project