Production hardening: unwrap safety, 14 new tests, diagnostics

Harden unwrap() calls in handler hot paths (handshake, encrypted,
rekey, session handlers) with proper error propagation.

Add 14 tests: profile rejection (6), MMP forward-compat (4),
discovery min_mtu pruning (3), XX duplicate msg1 dedup (1).

Add NodeProfile Display impl with structured tracing for profile
mismatch logging. Expose bloom compression diagnostics
(total_compressed_bytes, total_raw_bytes) in control socket.

Add module documentation for XX identity timing, profile decision
tree, and bloom codec strategy.

src/node/stats.rs

@@ -222,6 +222,9 @@ pub struct BloomStats {
     pub nacks_received: u64,
     // Adaptive sizing
     pub size_changes: u64,
+    // Compression tracking
+    pub total_compressed_bytes: u64,
+    pub total_raw_bytes: u64,
 }
 
 impl BloomStats {
@@ -241,6 +244,8 @@ impl BloomStats {
             nacks_sent: self.nacks_sent,
             nacks_received: self.nacks_received,
             size_changes: self.size_changes,
+            total_compressed_bytes: self.total_compressed_bytes,
+            total_raw_bytes: self.total_raw_bytes,
         }
     }
 }
@@ -415,6 +420,8 @@ pub struct BloomStatsSnapshot {
     pub nacks_sent: u64,
     pub nacks_received: u64,
     pub size_changes: u64,
+    pub total_compressed_bytes: u64,
+    pub total_raw_bytes: u64,
 }
 
 #[derive(Clone, Debug, Default, Serialize)]