Initial implementation of mcq — document reading queue

Single-binary service: push raw markdown via REST/gRPC API, read rendered
HTML through mobile-friendly web UI. MCIAS auth on all endpoints, SQLite
storage, goldmark rendering with GFM and syntax highlighting.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

proto/mcq/v1/mcq.proto

@@ -0,0 +1,90 @@
+syntax = "proto3";
+
+package mcq.v1;
+
+option go_package = "git.wntrmute.dev/mc/mcq/gen/mcq/v1;mcqv1";
+
+import "google/protobuf/timestamp.proto";
+
+// DocumentService manages queued documents for reading.
+service DocumentService {
+  rpc ListDocuments(ListDocumentsRequest) returns (ListDocumentsResponse);
+  rpc GetDocument(GetDocumentRequest) returns (Document);
+  rpc PutDocument(PutDocumentRequest) returns (Document);
+  rpc DeleteDocument(DeleteDocumentRequest) returns (DeleteDocumentResponse);
+  rpc MarkRead(MarkReadRequest) returns (Document);
+  rpc MarkUnread(MarkUnreadRequest) returns (Document);
+}
+
+// AuthService handles MCIAS login and logout.
+service AuthService {
+  rpc Login(LoginRequest) returns (LoginResponse);
+  rpc Logout(LogoutRequest) returns (LogoutResponse);
+}
+
+// AdminService provides health checks.
+service AdminService {
+  rpc Health(HealthRequest) returns (HealthResponse);
+}
+
+message Document {
+  int64 id = 1;
+  string slug = 2;
+  string title = 3;
+  string body = 4;
+  string pushed_by = 5;
+  google.protobuf.Timestamp pushed_at = 6;
+  bool read = 7;
+}
+
+message ListDocumentsRequest {}
+
+message ListDocumentsResponse {
+  repeated Document documents = 1;
+}
+
+message GetDocumentRequest {
+  string slug = 1;
+}
+
+message PutDocumentRequest {
+  string slug = 1;
+  string title = 2;
+  string body = 3;
+}
+
+message DeleteDocumentRequest {
+  string slug = 1;
+}
+
+message DeleteDocumentResponse {}
+
+message MarkReadRequest {
+  string slug = 1;
+}
+
+message MarkUnreadRequest {
+  string slug = 1;
+}
+
+message LoginRequest {
+  string username = 1;
+  string password = 2; // security: never logged
+  string totp_code = 3;
+}
+
+message LoginResponse {
+  string token = 1; // security: never logged
+}
+
+message LogoutRequest {
+  string token = 1; // security: never logged
+}
+
+message LogoutResponse {}
+
+message HealthRequest {}
+
+message HealthResponse {
+  string status = 1;
+}