fix(coord): persist vpn_ip in NVS to survive elided Node.Addresses

[fudio101]

Summary

• On repeat registration of an already-known node, the control plane can omit Node.Addresses (and HomeDERP) in both RegisterResponse and the initial MapResponse — the client's own VPN IP is assigned once and never changes, so the server just doesn't resend it.
• vpn_ip only ever lived in RAM with no fallback, so every reboot after the node's first-ever registration silently regressed to 0.0.0.0 while DERP/DISCO/WireGuard kept working fine (none of that traffic depends on the node knowing its own address) — matching the exact symptom in 3.1.0: vpn_ip stays 0.0.0.0 while state=CONNECTED, control-plane last-seen never advances #72 (state=CONNECTED, DERP/DISCO healthy, vpn_ip stuck at 0, Tailscale admin "last seen" never advancing).
• Fix: persist vpn_ip in the "microlink" NVS namespace (same namespace as the machine/WG/DISCO keys) and restore it as a fallback during init, mirroring the existing ml_peer_nvs.c pattern already used for the peer cache. Save on every site that can set vpn_ip (do_register, the do_fetch_peers MapResponse fallback, and the long-poll update path), gated on the value actually changing.

Closes #72

Test plan

Verified on real hardware (LilyGo T-Display-S3), by pinning a local microlink override into a consumer project and driving two boots:

• Boot 1 (factory reset → brand-new node): first-ever registration necessarily includes full Node.Addresses → log shows Our VPN IP: 100.105.164.125, DERP connects, 6 peers handshake successfully. Value gets persisted to NVS.
• Boot 2 (normal reboot, same node): registration reproduces the bug — Node.Addresses and HomeDERP are both omitted again (Home DERP region: 9 (default) fires, no Our VPN IP: line) — but microlink: VPN IP restored from NVS: 100.105.164.125 fires at init, before registration even starts, and vpn_ip stays correct throughout the session (DERP connects, DISCO PONGs succeed, no crashes).
• Confirmed via log evidence this is not a cert/auth issue: the control-plane channel is Noise-encrypted (no certs involved), DERP TLS connects successfully in both boots, and registration itself succeeds cleanly (Fetching peers... runs, no RegisterResponse error / not authorized) — only the Addresses field is selectively omitted, consistent with delta-style server behavior for a known node.
• No automated test suite exists for this component (hardware-in-the-loop only, per TESTING_GUIDE.md) — this PR relies on the hardware repro above as the regression check.

🤖 Generated with Claude Code