feat: PQ hybrid groundwork — liboqs vendored, PQHybrid, KDF wiring

- ext/liboqs: vendored (ML-KEM/ML-DSA ready), -isystem ext/liboqs/include
- node/PQHybrid.*: KDF over X25519 agree + ML-KEM-768 encaps scaffold
- wire into IncomingPacket/Node/Bond/selftest/OneService paths
- zeroidc ext.rs: URL param parser unit tests
- SPEC.md: BackOne quantum-safe task table (T1–T23)
- research doc: hybrid PQ fork plan (ML-KEM+X25519, ML-DSA+Ed25519)

ext/liboqs/.CMake/toolchain_windows-amd64.cmake

@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: MIT
+
+# How to use:
+# apt install gcc-mingw-w64
+# cmake -GNinja -DCMAKE_TOOLCHAIN_FILE=../.CMake/toolchain_windows-amd64.cmake ..
+
+set(CMAKE_SYSTEM_NAME Windows)
+set(CMAKE_SYSTEM_PROCESSOR AMD64)
+set(CMAKE_CROSSCOMPILING ON)
+
+set(PREFIX x86_64-w64-mingw32)
+set(CMAKE_C_COMPILER ${PREFIX}-gcc)
+
+set(CMAKE_CROSSCOMPILING_EMULATOR "wine")
+set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER)
+set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY)
+set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY)
+set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY)