Production hardening: unwrap safety, 14 new tests, diagnostics

Harden unwrap() calls in handler hot paths (handshake, encrypted,
rekey, session handlers) with proper error propagation.

Add 14 tests: profile rejection (6), MMP forward-compat (4),
discovery min_mtu pruning (3), XX duplicate msg1 dedup (1).

Add NodeProfile Display impl with structured tracing for profile
mismatch logging. Expose bloom compression diagnostics
(total_compressed_bytes, total_raw_bytes) in control socket.

Add module documentation for XX identity timing, profile decision
tree, and bloom codec strategy.

src/node/bloom.rs

@@ -113,6 +113,8 @@ impl Node {
         } else {
             self.stats_mut().bloom.full_sends += 1;
         }
+        self.stats_mut().bloom.total_compressed_bytes += stats.compressed_bytes as u64;
+        self.stats_mut().bloom.total_raw_bytes += (stats.raw_words * 8) as u64;
 
         // Record send and store the filter for change detection
         debug!(