feat: replace connection keys with short seed-derived rtun3 keys

Connection keys are now a ~49-char seed (rtun3.) instead of a bundled
~1740-char certificate blob. Both endpoints deterministically derive an
identical Ed25519 CA from the seed and mint ephemeral server/client leaves
at startup (keyderive.rs); the app-layer auth token is derived from the seed.
Target is passed separately on connect (resocks-style).

- connkey.rs: rtun3 seed parse/format
- keyderive.rs: CA/server/client/token derivation
- keygen takes no args; connect requires --target
- remove miniz_oxide; TLS layer unchanged
- add determinism + key-based e2e + wrong-seed-rejected tests
- update wiki, README, design spec, CI smoke

Cargo.toml

@@ -29,7 +29,6 @@ hyper-util = { version = "0.1", features = ["full", "server-graceful"] }
 http-body-util = "0.1"
 tower-service = "0.3"
 base64 = "0.22"
-miniz_oxide = "0.8"
 sha2 = "0.10"
 bytes = "1"
 futures = "0.3"