feat(pqid): hybrid post-quantum identity, AGPL-3.0 license

Player identity is now Ed25519 and ML-DSA-65 (NIST FIPS 204) together,
both signatures required. An attacker must break lattice assumptions and
elliptic curves, not either one — which covers both the quantum threat to
Ed25519 and the possibility that a 2024 lattice standard does not hold.

Signatures are domain-separated to this application so one captured from
another ML-DSA protocol cannot be replayed.

Licensed AGPL-3.0: a fork stood up as a service must publish its changes,
which is what keeps a provably-fair platform honest.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

go.mod

@@ -2,13 +2,17 @@ module github.com/drjones/quantum-arcade
 
 go 1.26.5
 
-require github.com/jackc/pgx/v5 v5.10.0
+require (
+	github.com/cloudflare/circl v1.6.5
+	github.com/coder/websocket v1.8.15
+	github.com/jackc/pgx/v5 v5.10.0
+)
 
 require (
-	github.com/coder/websocket v1.8.15 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	golang.org/x/sync v0.17.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/text v0.29.0 // indirect
 )