Introduces a `nats` feature-gated event system that publishes
lease lifecycle events (issued, revoked, revocation_failed) to NATS
subjects under a configurable prefix.
- Add `VaultEvent` enum with serde tag-based serialization
- Add `VaultEventPublisher` with best-effort fire-and-forget semantics
- Add `NatsVaultConfig` with sensible defaults (disabled by default)
- Wire `VaultEventPublisher` into `LeaseRevocationWorker`
- Gate all event code behind `#[cfg(feature = "nats")]`
- Add badges, competitive comparison, and 30-sec demo to README
- Add Production Status section showing OQS backend is production-ready
- Mark PQC KEM/signing operations complete in roadmap
- Fix GitHub URL
- Create CHANGELOG.md documenting all recent changes
Positions SecretumVault as first Rust vault with production PQC.
