mempool: keep accept time across restart; net: rate limit addrv2 before AddrMan

[bkeroack]

Fixes #1029. Fixes #1030. One commit each.

Mempool entries keep their accept time across a restart (#1029)

Schema bump: this moves the mempool sidecar from schema 3 to 4. docs/ORIENT.md lists a schema bump under "Ask first", so please weigh in on that part in particular. The main store (SCHEMA_VERSION 26) is untouched.

• Each packed record now stores accept_secs after sigops (fee‖weight‖sigops‖accept_secs‖txid‖wtxid‖tx‖vin aux). SIGOP_COST_OFF is unchanged.
• Clock: the mempool stamps the time in finish_commit from the hub's mock clock. The mock_now atomic is now an Arc shared with ActiveMempool, so setmocktime reaches it without another step added to the fan-out clock: one mockable node-time source instead of per-subsystem mock clocks #821 describes.
• AcceptResult.accept_secs carries the value, and the hub indexes admits with it, so RAM and disk agree.
• Open: the hub takes the loaded (txid, wtxid, accept_secs) and indexes each entry still live. Loaded entries are not added to age_inv, so a restart queues no INVs, as before.
• Migration: a schema 1–3 sidecar converts on open. Its records get the migrate's wall-clock second, so expiry for those entries counts from the upgrade.
• Downgrade: an older binary refuses schema 4 as an unreadable image, moves it aside under mempool/torn-<unix>/ and starts with an empty mempool. Class A is not affected.

Tests:

• reopen_keeps_accept_time_and_expiry (hub): admit under mocktime, reopen, then check accept_time_txid and that the entry expires on schedule. It fails on master, where the time after reopen is None.
• schema3_converts_on_open_with_migrate_accept_time: sigops are kept, the time is stamped once and stays durable.
• The packed codec tests cover the v2, v3 and v4 layouts.

Addresses are rate limited before AddrMan (#1030)

AddrTokenBucket follows Core v31.1 ProcessMessage ADDR:

• It starts with one token, then refills at 0.1 per second up to 1000.
• on_addrv2 takes tokens before learn_addrv2. Only the admitted prefix is learned and relayed; the rest are dropped.
• The bucket runs on the peer's node clock, the same clock that sets connected_at.
• IBD peers spend their own bucket (IbdWorkState::addr_buckets, dropped on peer death).
• A peer with the addr whitelist permission is not limited (p2p_addrv2_relay.py runs with -whitelist=addr@127.0.0.1).
• getpeerinfo gains addr_processed and addr_rate_limited.

Not included: Core credits 1000 tokens when it sends getaddr. Here only addr-fetch peers get getaddr, and on_addrv2 drops their multi-address reply before learning, so the credit would be dead code. If outbound full-relay peers start getting a getaddr (Core sends one at handshake), the credit belongs with that change. Core also shuffles the list before spending tokens; this takes the prefix.

Tests:

• addrv2_flood_is_rate_limited_before_addrman: a fresh inbound peer's 1000-entry addrv2 teaches one address, and the counters are (1, 999). With addr@ all 1000 are learned. It fails on master, where 1000 addresses reach AddrMan.
• ibd_peer_addr_flood_takes_one_token.
• The hostile relay journey now advances node time 10,000 s to refill the bucket, instead of relying on a full bucket at connect.

Checks

• Local: fmt, clippy -D warnings, deny, ast-grep.sh, cargo test --workspace and ci-os-smoke.sh all pass.
• Core functional, run locally against this build: mempool_expiry, mempool_limit, mempool_unbroadcast, p2p_tx_privacy, p2p_addrv2_relay, p2p_addrfetch and p2p_addr_selfannouncement all pass.

🤖 Generated with Claude Code