feat: replace connection keys with short seed-derived rtun3 keys

Connection keys are now a ~49-char seed (rtun3.) instead of a bundled
~1740-char certificate blob. Both endpoints deterministically derive an
identical Ed25519 CA from the seed and mint ephemeral server/client leaves
at startup (keyderive.rs); the app-layer auth token is derived from the seed.
Target is passed separately on connect (resocks-style).

- connkey.rs: rtun3 seed parse/format
- keyderive.rs: CA/server/client/token derivation
- keygen takes no args; connect requires --target
- remove miniz_oxide; TLS layer unchanged
- add determinism + key-based e2e + wrong-seed-rejected tests
- update wiki, README, design spec, CI smoke

droid-wiki/security.md

@@ -21,11 +21,20 @@ The E2E test `auth_required_in_addition_to_mtls` verifies that valid mTLS alone
 
 ## Auth token
 
-- Generated as 32 random bytes encoded as 64 hex characters.
+- Derived from the connection key seed as `sha256(seed || "rustunnel-auth-token")`
+  (first 16 bytes, hex), or 32 random bytes as 64 hex characters for the file-based path.
 - Compared with a constant-time XOR loop to prevent timing attacks.
 - Never logged in raw form. All log output uses the `Redacted` wrapper.
 - Auth failures are terminal: the connector's reconnect loop exits on auth failure rather than retrying.
 
+## Connection key as seed
+
+- The connection key is a 32-byte seed (prefix `rtun3.`). It confers full access —
+  possession of the key lets you derive the same CA and ephemeral leaves, so treat it
+  as a secret.
+- Both endpoints derive the same CA; a connector using a different seed cannot
+  authenticate to a listener (verified by `e2e_wrong_seed_key_is_rejected`).
+
 ## Secret redaction
 
 - `Redacted` in `src/redact.rs` wraps strings and displays `[REDACTED(len=N)]`.
@@ -33,7 +42,7 @@ The E2E test `auth_required_in_addition_to_mtls` verifies that valid mTLS alone
 - `redact_config_json()` scrubs sensitive keys from JSON.
 - `is_sensitive()` detects PEM private key blocks.
 - `is_auth_token()` detects long alphanumeric strings.
-- `is_connection_key()` detects strings starting with `rtun2.`.
+- `is_connection_key()` detects strings starting with `rtun3.`.
 
 The E2E test `ops_auth_failure_is_actionable_and_redacted` verifies that error messages do not contain raw token values.