v2.0.0 — Longfellow (Sumcheck + Ligero)

Migration from Circom/Groth16 to Google's Longfellow proving system.

Breaking changes:
- No WASM/browser proving (server-side only)
- No SD-JWT support (mdoc only)
- Proof size increased from ~800B to ~360KB (transparent proofs, no trusted setup)

New features:
- Transparent ZK proofs — no trusted setup, no ceremony files
- Post-quantum security (hash-based commitments + ML-KEM-768 escrow)
- QEAA proof attestation service (Article 45d)
- Identity escrow with court-ordered decryption (AES-256-GCM + ML-KEM-768)
- Content-addressed proof storage (SHA-256 CID)
- Pre-generated circuit cache (0ms cold start)
- Benchmark binary with ZK pipeline + escrow measurements

Performance (Intel 8C/16T, median of 5):
- Prove: ~1.2s (1-4 attributes)
- Verify: ~0.7s
- Proof size: ~360 KB
- Escrow: <0.5ms total
- Circuit load from cache: 0.02ms

Compliance:
- eIDAS 2.0 Articles 5a(16), 45a, 45d
- ISO 18013-5 mdoc
- SOG-IS / NIST approved primitives
- GDPR Article 25

feat(verify): add debug log panel with show/copy/clear for QR scanner

Initial commit