Add MIT license, CONTRIBUTING, and SECURITY docs for open-sourcing

Preparing to open the project up beyond this repo's own use:
- LICENSE: MIT, and a "license": "MIT" field on the root and all three
  workspace package.json files.
- CONTRIBUTING.md: dev workflow, the mock-relay testing setup (most
  sandboxes/CI have no route to public Nostr relays, and registration
  needs a 2-of-N ack quorum so a single mock relay always fails), the
  spec-first process for anything touching wire format or crypto
  (docs/spec.md is canonical; speculative ideas go in their own doc, not
  the spec), and stricter expectations for crypto/key-handling changes.
- SECURITY.md: private vulnerability disclosure via GitHub's advisory
  flow rather than public issues, given this handles private keys and
  password-derived secrets client-side; states current audit status
  plainly (none yet).
- README: short "Contributing" section pointing at all three.

Co-Authored-By: Claude <[email protected]>
Claude-Session: https://claude.ai/code/session_01GWJbXXhvTx9wo59jSz57J6

README.md

@@ -142,3 +142,10 @@ HKDF, ScalarExpand, AES-256-GCM, JCS, fixed padding buckets).
 - Passphrases are generated from the EFF long Diceware wordlist
   (`diceware-wordlist-en-eff`), matching the spec's ~12.9-bits/word,
   six-word/~77-bit default (§9.2).
+
+## Contributing
+
+MIT licensed — see `LICENSE`. See `CONTRIBUTING.md` for the dev workflow,
+mock-relay testing (no route to public relays in most sandboxes/CI), and
+the spec-first process for anything touching wire format or crypto. Found
+a security issue? See `SECURITY.md` rather than opening a public issue.