feat(block2): commons_core social foundation — derivation, types, interfaces, WoT

First production slice of Block 2 (transport foundation), on the vetted
pure-Dart nostr package (LGPL-3.0, AGPL-compatible, Flutter-free):

- NostrKeyDerivation: seed -> secp256k1 Nostr identity via domain-separated
  HKDF (reuses cryptography's Hkdf like BackupBox), one-way, versioned. Wraps
  nostr's Keys for signing. Tested (reproducible, avalanche, one-way, integrates
  with IdentityService seed).
- Agnostic value types: Offer/OfferType/OfferStatus/DiscoveryQuery/PublishResult,
  Certification.
- Transport interfaces: OfferTransport, MessageTransport (+PrivateMessage),
  TrustTransport — the three sibling contracts.
- WebOfTrust: pure Duniter membership rule (threshold + distance, fixpoint).
  Promoted from the spike; TDD (7 cases).

No network yet (that's the next slice). commons_core: 50 tests green, analyzer
clean. Block 1 APIs unchanged.

packages/commons_core/pubspec.yaml

@@ -17,6 +17,10 @@ dependencies:
   meta: ^1.15.0
   # Pure-Dart AEAD + HKDF (Apache-2.0) for sealed backups. No FFI, host-testable.
   cryptography: ^2.7.0
+  # Pure-Dart Nostr protocol (LGPL-3.0, AGPL-compatible, Flutter-free): events,
+  # signing, NIP-19, NIP-44, gift wrap — the vetted crypto for the social layer
+  # transport. We keep the relay/websocket layer and our derivation on top.
+  nostr: ^2.0.0
 
 dev_dependencies:
   lints: ^6.0.0