feat(syndesis): renderer pairing protocol with pinned TLS

[forkwright]

From Phase 03 PLAN.md, REQ-06.

Renderer discovery and authentication:

• mDNS discovery via mdns-sd (zero-config, no internet required)
• Self-signed TLS certificate generation
• Pinned cert model: renderer pins server cert on first connection
• API key exchange during pairing ceremony
• No CA dependency

Decision: API key + pinned self-signed TLS (from plan decisions table).

[forkwright]

Closing — fully delivered by PR #128 (mDNS discovery, TOFU pinned-cert pairing, API key exchange, renderer registry).