security: encrypt mesh TCP payload after handshake (AES-GCM + ECDH)

[krwg]

Summary

Peer identity is already strong (Ed25519 signed handshake/announce + pubkey pinning), but TCP payloads are plaintext JSON lines. Add session encryption after handshake without discarding the existing identity model.

Current state

• AuthN: mesh-identity.js (sign/verify, pinning)
• Framing: tcp-framing.js newline JSON over net sockets — no confidentiality

Proposed design (minimally invasive)

1. Generate X25519 keypair (or separate ECDH material) alongside mesh identity
2. Extend handshake/ack with ecdhPubkey covered by the same canonical signature (prevent MITM swapping only ECDH)
3. Shared secret → HKDF → AES-256-GCM session key
4. Encrypt before socket.write; decrypt in framing push before line split (stateful nonce/counter OK on TCP)
5. Bump MESH_PROTO (e.g. 1 → 2) with explicit plaintext fallback for old peers + UI warning (no silent downgrade)
6. Surface encrypted/plaintext in trust/peer UI state

Acceptance

• New peers get encrypted TCP payloads
• Mixed-version LAN warns in UI
• Identity/pinning behavior preserved
• Protocol bump documented