companions: qc (qrypt.chat terminal client)

[ralyodio]

This adds @profullstack/qryptchat as an npm companion, so install.sh, cli-tools link and cli-tools update all put qc on PATH.

qc is qrypt.chat in the terminal:

• bare qc is a full-screen hqtui chat client
• qc chats|read|send|listen are for scripts
• qc mcp is an MCP server

It encrypts with ML-KEM-1024 on the box, and qc login is a browser handoff, so no account data lives in this repo.

The test lists and the README table are updated, and the README's npm companion count goes from seven to eight. test/companions.test.ts passes, 36/36.

The full suite and tsc each have failures already on master, not from this change:

• test/root-ubuntu.test.ts, "carries no personal identifiers", which scans root-ubuntu.sh
• a session-timing test
• one TS2532 at test/root-ubuntu.test.ts:1461

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

32 finding(s)

HIGH/CRITICAL: 7 | MEDIUM: 12 | LOW: 13

Severity	Rule	Location
HIGH	py-ssrf-outbound-request	dev2/dev2-site:147
HIGH	py-ssrf-outbound-request	dev2/dev2-site:876
HIGH	py-ssrf-outbound-request	dev2/dev2-site:1565
HIGH	sh-remote-script-execution	root-ubuntu.sh:3236
HIGH	sh-remote-script-execution	root-ubuntu.sh:3237
HIGH	sh-remote-script-execution	root-ubuntu.sh:5071
HIGH	sh-remote-script-execution	root-ubuntu.sh:5075
MEDIUM	sql-template-interpolation	dev2/dev2-site:1102
MEDIUM	sql-template-interpolation	dev2/dev2-site:1179
MEDIUM	sh-remote-script-execution	root-ubuntu.sh:5248
MEDIUM	redos-nested-quantifier	src/domain-free.ts:56
MEDIUM	redos-nested-quantifier	src/emoji.ts:167
MEDIUM	redos-nested-quantifier	src/icon.ts:166
MEDIUM	redos-nested-quantifier	src/mail.ts:1042
MEDIUM	sql-template-interpolation	src/users-dump.ts:487
MEDIUM	sql-string-concatenation	src/users-dump.ts:507
MEDIUM	sql-template-interpolation	src/users-dump.ts:540
MEDIUM	sql-string-concatenation	src/users-dump.ts:574
MEDIUM	redos-nested-quantifier	src/wcag.ts:556
LOW	secret-generic-credential	src/credentials.ts:36
LOW	secret-generic-credential	src/credentials.ts:53
LOW	secret-generic-credential	src/credentials.ts:56
LOW	secret-generic-credential	src/user-export.ts:632
LOW	secret-generic-credential	src/user-export.ts:638
LOW	secret-generic-api-key	test/credentials.test.ts:208
LOW	secret-generic-credential	test/mail.test.ts:141
LOW	secret-generic-credential	test/proxy.test.ts:52
LOW	secret-generic-credential	test/proxy.test.ts:68
LOW	secret-generic-credential	test/shorten.test.ts:36
LOW	secret-database-url	test/users-dump.test.ts:108
LOW	secret-database-url	test/users-dump.test.ts:119
LOW	secret-database-url	test/users-dump.test.ts:120

Snippets are redacted; ThreatCrush never prints matched credential material.