docs(tests): TEST_CASES.md + wire-tap proof for university practice

Adds proof artifacts that the PQ tunnel is real:

- crates/aura-proto/tests/pq_wire_tap.rs — new integration test that
  intercepts every byte flowing on the in-memory transport and asserts:
  (1) ClientHello payload = 32 + 1184 + 32 (X25519 + ML-KEM-768 ek + nonce),
  (2) ServerHello payload = 32 + 1088 + 32 (X25519_eph + ML-KEM-768 ct + nonce),
  (3) a 56-byte plaintext marker shipped in a Data frame is absent from
      the wire in both directions,
  (4) ServerAuth/Data AEAD bodies have Shannon entropy >= 7 bits/byte.

- TEST_CASES.md — Russian-language report mapping 12 test cases to the
  exact code and captured outputs (KAT, hybrid round-trip, AEAD tamper
  detection, mutual X.509 rejection, replay window, 1000-packet flow,
  in-vivo ping, bench-crypto timings, new wire-tap proof).

- docs/test_evidence/ — full captured stdout of cargo test runs and
  aura bench-crypto, referenced from TEST_CASES.md.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docs/test_evidence/aura_pki_tests.txt

@@ -0,0 +1,41 @@
+   Compiling aura-pki v0.1.0 (/Users/xah30/AuraVPN/crates/aura-pki)
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 10.53s
+     Running unittests src/lib.rs (target/debug/deps/aura_pki-c13dd2248440635d)
+
+running 0 tests
+
+test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
+
+     Running tests/crl_signing.rs (target/debug/deps/crl_signing-e091e8e0bce1f73f)
+
+running 7 tests
+test missing_marker_is_rejected ... ok
+test tampered_body_fails_verification ... ok
+test empty_crl_round_trip ... ok
+test unknown_header_is_rejected ... ok
+test tampered_signature_fails_verification ... ok
+test signature_against_wrong_ca_fails ... ok
+test signed_crl_round_trip_verifies ... ok
+
+test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
+
+     Running tests/pki.rs (target/debug/deps/pki-a351653bfbc8049b)
+
+running 8 tests
+test test_empty_chain_rejected ... ok
+test test_client_cert_not_valid_as_server_name ... ok
+test test_ca_issue_server_cert ... ok
+test test_ca_issue_client_cert ... ok
+test test_ca_issue_client_cert_uuid_cn ... ok
+test test_invalid_cert_rejected ... ok
+test test_save_load_roundtrip ... ok
+test test_revoked_cert_rejected ... ok
+
+test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
+
+   Doc-tests aura_pki
+
+running 0 tests
+
+test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
+