feat(cubesys/cubecrypt): R4 challenge-response auth + R5/R6 wiring

- cubecrypt/src/auth.rs: HMAC-SHA256 signed HELLO (sign_hello/verify_hello),
  random_nonce_hex entropy source (plan R4)
- cube-server: --auth-key enables CHALLENGE/HELLO handshake; auth_handshake is
  a module-level free fn (run(self) consumes self, so the thread closure can
  only reach the captured psk). Resolves the earlier E0425 compile failure
- cubec.rs client: --auth-key builds a signed HELLO frame
- commands.rs: audit op constants + read-gating hooks wired into admit_read
- audit.rs: per-tenant append-only audit log in a Null-cube range (plan R6)
- clippy -D warnings clean; full ./check gate ALL CHECKS PASSED (61 tests)

cubecrypt/src/lib.rs

@@ -31,9 +31,11 @@
 #![forbid(unsafe_code)]
 #![warn(missing_docs)]
 
+pub mod auth;
 pub mod env;
 pub mod transform;
 
+pub use auth::{hex_encode, hmac_sha256, random_nonce_hex, sign_hello, verify_hello};
 pub use env::{CubeEnv, EnvError, Selector, HEADER_FLAG_ENCRYPTED};
 pub use transform::{CryptoError, Key, KeySlot, TransformId};