chore: initial commit for v0.0.1

DChain single-node blockchain + React Native messenger client.

Core:
- PBFT consensus with multi-sig validator admission + equivocation slashing
- BadgerDB + schema migration scaffold (CurrentSchemaVersion=0)
- libp2p gossipsub (tx/v1, blocks/v1, relay/v1, version/v1)
- Native Go contracts (username_registry) alongside WASM (wazero)
- WebSocket gateway with topic-based fanout + Ed25519-nonce auth
- Relay mailbox with NaCl envelope encryption (X25519 + Ed25519)
- Prometheus /metrics, per-IP rate limit, body-size cap

Deployment:
- Single-node compose (deploy/single/) with Caddy TLS + optional Prometheus
- 3-node dev compose (docker-compose.yml) with mocked internet topology
- 3-validator prod compose (deploy/prod/) for federation
- Auto-update from Gitea via /api/update-check + systemd timer
- Build-time version injection (ldflags → node --version)
- UI / Swagger toggle flags (DCHAIN_DISABLE_UI, DCHAIN_DISABLE_SWAGGER)

Client (client-app/):
- Expo / React Native / NativeWind
- E2E NaCl encryption, typing indicator, contact requests
- Auto-discovery of canonical contracts, chain_id aware, WS reconnect on node switch

Documentation:
- README.md, CHANGELOG.md, CONTEXT.md
- deploy/single/README.md with 6 operator scenarios
- deploy/UPDATE_STRATEGY.md with 4-layer forward-compat design
- docs/contracts/*.md per contract

deploy/single/systemd/dchain-update.service

@@ -0,0 +1,35 @@
+# DChain single-node pull-and-restart service.
+#
+# Install:
+#   sudo cp dchain-update.service dchain-update.timer /etc/systemd/system/
+#   sudo systemctl daemon-reload
+#   sudo systemctl enable --now dchain-update.timer
+#
+# View runs:
+#   systemctl list-timers dchain-update.timer
+#   journalctl -u dchain-update.service -n 200 --no-pager
+#
+# The timer (sibling file) fires the service; the service runs update.sh
+# once per fire, which itself is a no-op when HEAD hasn't moved.
+
+[Unit]
+Description=DChain node: fetch latest, rebuild, rolling restart
+Documentation=file:///opt/dchain/deploy/UPDATE_STRATEGY.md
+# Don't try to update while Docker is still coming up after a host reboot.
+After=docker.service network-online.target
+Requires=docker.service
+
+[Service]
+Type=oneshot
+# REPO_DIR + COMPOSE_FILE come from the update script's defaults; override
+# here with Environment= if you moved the checkout to a non-default path.
+WorkingDirectory=/opt/dchain
+EnvironmentFile=-/opt/dchain/deploy/single/node.env
+ExecStart=/opt/dchain/deploy/single/update.sh
+
+# Lock down the unit — update.sh only needs git + docker + curl.
+PrivateTmp=true
+NoNewPrivileges=true
+ProtectSystem=strict
+ReadWritePaths=/opt/dchain /var/run/docker.sock
+ProtectHome=true