Monocypher[0], unironically. Though it's not header-only (it's a single C file and a separate header), but it's easy enough to merge the two. It even beats your licensing requirements (CC-0 or BSD 2-clause dual-license).
Edit: Also, not sure why the author chose to use Argon2i over Argon2id as the PBKDF for Monocypher, my perception was that the id variant should be used unless you have a reason not to. Would be interested to hear other opinions on this.
[1] https://loup-vaillant.fr/articles/rolling-your-own-crypto , discussed here:
https://news.ycombinator.com/item?id=13221923 and related
[0] https://monocypher.org/quality-assurance/audit
No high or critical issues were found. The issues that were found were addressed in a timely manner.