Phase 0: skeleton, streaming encryption (spike A)

Repository skeleton (app id ng_backup, AGPL-3.0-or-later), KeyRing with
KDF subkeys, keyed blob ids and Argon2id key wrapping, and StreamCipher
(secretstream XChaCha20-Poly1305, framed, bounded memory).

Spike A: 1 GiB round trip with memory_limit=64M, peak < 2 MiB, ~160/122
MiB/s; tampering, truncation, wrong key/passphrase are rejected.

spikes/bootstrap.php

@@ -0,0 +1,14 @@
+<?php
+
+declare(strict_types=1);
+
+// Minimal PSR-4 autoloader so the spikes run without Nextcloud or composer.
+spl_autoload_register(static function (string $class): void {
+	$prefix = 'OCA\\NgBackup\\';
+	if (str_starts_with($class, $prefix)) {
+		$file = __DIR__ . '/../lib/' . str_replace('\\', '/', substr($class, strlen($prefix))) . '.php';
+		if (is_file($file)) {
+			require $file;
+		}
+	}
+});