Split protocol.rs into protocol/ directory, standardize imports, clean lib.rs

- Replace use super::*; in node/lifecycle.rs with explicit imports,
  remove 10 resulting unused imports from node/mod.rs
- Split protocol.rs (1838 lines) into protocol/ directory:
  mod.rs (re-exports), error.rs, link.rs, tree.rs, filter.rs,
  discovery.rs, session.rs — each with co-located tests
- Remove unused flat re-exports from lib.rs for internal utility
  modules (wire, index, rate_limit, icmp, noise, tun)
- 316 tests pass, zero warnings

src/lib.rs

@@ -61,24 +61,3 @@ pub use peer::{
 // Re-export node types
 pub use node::{Node, NodeError, NodeState};
 
-// Re-export TUN types
-pub use tun::{log_ipv6_packet, shutdown_tun_interface, TunDevice, TunError, TunState, TunTx, TunWriter};
-
-// Re-export ICMPv6 types
-pub use icmp::{build_dest_unreachable, should_send_icmp_error, DestUnreachableCode, Icmpv6Type};
-
-// Re-export Noise types (HandshakeState not re-exported to avoid conflict with peer::HandshakeState)
-pub use noise::{CipherState, HandshakeRole, NoiseError, NoiseSession};
-
-// Re-export index types
-pub use index::{IndexAllocator, IndexError, SessionIndex};
-
-// Re-export rate limiting types
-pub use rate_limit::{HandshakeRateLimiter, TokenBucket};
-
-// Re-export wire format types
-pub use wire::{
-    build_encrypted, build_msg1, build_msg2, EncryptedHeader, Msg1Header, Msg2Header,
-    DISCRIMINATOR_ENCRYPTED, DISCRIMINATOR_MSG1, DISCRIMINATOR_MSG2, ENCRYPTED_MIN_SIZE,
-    ENCRYPTED_OVERHEAD, MSG1_WIRE_SIZE, MSG2_WIRE_SIZE,
-};