* feat: add dstack TEE support for confidential deployment

- Key provider: Auto/Static/Dstack key resolution with Unix socket client
- Column encryption: AES-256-GCM with version-byte prefix for gradual migration
- Attestation endpoint: GET /attestation returns TDX quote in TEE mode
- Docker: CARGO_FEATURES build arg + compose files for 3 dstack topologies
- Feature-gated: `cargo build --features dstack` enables TEE support

* feat: add inTEE flag to /version endpoint

* chore: add changeset for dstack TEE support

* refactor: rename crates and reorganize workspace structure

- tinycloud-lib → tinycloud-auth (better communicates purpose)
- Root binary src/ → tinycloud-node-server/ (own Cargo.toml)
- siwe/, siwe-recap/, cacao/ → dependencies/ (forked crates)
- Root Cargo.toml: workspace-only (no [package])
- Global rename tinycloud_lib → tinycloud_auth in 33 .rs files
- Update CI, Dockerfile, changeset script, docs

* docs: fix data directory references to use ./data/ consistently

CLAUDE.md still referenced the old ./tinycloud/ paths for caps.db and
blocks. Updated all references to match tinycloud.toml which uses ./data/.

* docs: fix stale data path in README

* fix: use ./data/ for sql and duckdb default paths

Default paths in config.rs pointed to ./tinycloud/sql and
./tinycloud/duckdb, inconsistent with tinycloud.toml which uses ./data/.

* feat: centralize data paths under storage.datadir config

All local data paths (database, blocks, sql, duckdb) now derive from a
single `storage.datadir` setting (default: ./data). This replaces
scattered hardcoded defaults that were inconsistent (sql/duckdb pointed
to ./tinycloud/ while everything else used ./data/).

Set TINYCLOUD_STORAGE_DATADIR to relocate all data with one variable.
Individual paths can still be overridden explicitly.

* fix: fmt and Docker build (add perl for openssl-sys)

- cargo fmt for long lines in config.rs and lib.rs
- Add perl to Dockerfile alpine packages (openssl-sys needs it)

* fix: add make to Dockerfile for openssl-sys build

SQL actors that die from idle timeout or panic now self-remove from the
DashMap registry, and the service layer detects dead handles and respawns
actors transparently on retry. Matches the existing DuckDB actor pattern.

* feat: add per-space storage quotas with admin API and billing sidecar integration

* style: fix rustfmt and remove obvious comments

* refactor: rename billing_url to quota_url, add quota_url to /version

The quota system is not billing-specific — any tinycloud operator can use
it. Rename TINYCLOUD_BILLING_URL → TINYCLOUD_QUOTA_URL, and expose the
configured quota URL in the /version endpoint so SDKs can discover it.

* feat: add /info endpoint, keep /version as legacy alias

Both endpoints return the same NodeInfo payload including quota_url.
New SDKs use /info, older clients continue to work via /version.

* fix: update doc comment from "billing sidecar" to "quota service"

)

The workspace reorg (#31) removed the version field from the root
Cargo.toml and renamed tinycloud-lib to tinycloud-core. This broke
the changeset version script and release workflow.

- Read version from tinycloud-node-server/Cargo.toml instead of root
- Update crate list: drop tinycloud-lib, add tinycloud-auth and tinycloud-node-server
- Add updateWorkspaceDeps to keep root workspace dependency versions in sync
- Fix release.yml version grep to use tinycloud-node-server/Cargo.toml

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>