feat: Venice E2EE attestation and message encryption

[sh1ftred]

Summary

Adds Venice E2EE (End-to-End Encryption) support for models prefixed with e2ee-*.

Extracted from the combined Venice+Tinfoil PR (#2), keeping only the Venice E2EE implementation. Tinfoil EHBP has been removed into a separate PR (#15).

What's included

Venice E2EE (client/VeniceE2EE.ts)

• isE2EEModel() — detects e2ee-* model IDs
• prepareE2EERequest() — fetches attestation from /tee/attestation, verifies server response, encrypts messages via ECDH + AES-256-GCM
• createE2EEDecryptTransform() — TransformStream for transparent SSE response decryption
• Full crypto primitives: ECDH secp256k1 key exchange, HKDF-SHA256 key derivation, AES-256-GCM per-message encryption

Integration points (client/RoutstrClient.ts)

• _prepareRoutedRequest(): Venice attestation runs before _spendToken(), so failed attestation costs nothing
• SSE streaming: response body teed through decrypt transform before normal SDK processing

Security docs

• VeniceE2EE-Weaknesses.md — catalogues weaknesses vs. the Tinfoil reference implementation

Known limitations

• Attestation verification is server-self-attested (checks verified, nonce, model fields)
• Does NOT parse the Intel TDX quote or verify the code fingerprint client-side
• See VeniceE2EE-Weaknesses.md for full analysis

[elkimek]

Just FYI Venice's E2EE models don't support tool calling AFAICT.

[sh1ftred]

Yep. That's why we didn't prioritize this ahah.