Fix Tor onion adverts missing port in Nostr overlay discovery

The Nostr overlay advert publisher serialized `transport: tor`
endpoints as a bare `<onion>.onion` hostname with no port. The Tor
address parser requires `<host>:<port>` form and rejected the bare
shape with `expected host:port`. Any peer receiving a Tor-only
advert went into a persistent retry-fail loop on jittered backoff
until the advert aged out of the discovery cache. The bug had been
latent for as long as Tor adverts have been published on Nostr, and
was masked in deployments where every node also advertised a
non-Tor transport (peers fell through to the working endpoint).
Surfaced first on a deployment where Tor was the only advert path.

Publisher now emits `<onion>.onion:<port>` using a new
`transports.tor.advertised_port` config field that defaults to 443,
matching the Tor `HiddenServicePort 443 127.0.0.1:<bind_port>`
convention. Operators whose torrc uses a non-default virtual port
can override.

Adds a unit test that pins the publisher/parser contract: formats
the advert exactly as the publisher does and asserts `parse_tor_addr`
accepts the result; asserts the bare-onion form (the bug) does not
parse, catching any future regression that drops the port again.

Parser is unchanged (already correct).

CHANGELOG.md

@@ -259,6 +259,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Tor onion adverts published over Nostr overlay discovery now
+  include the public-facing port (`<onion>.onion:<port>`) instead of
+  just the bare onion hostname. The publisher previously emitted a
+  bare onion that the parser refused (`expected host:port`),
+  producing a persistent retry-fail loop on any peer whose Tor
+  advert was the only entry in the discovery cache. New
+  `transports.tor.advertised_port` config field (default `443`,
+  matching the Tor `HiddenServicePort` convention) controls the
+  advertised port; operators with non-default virtual ports can
+  override.
 - Control socket path detection in fipsctl and fipstop now checks for
   the `/run/fips/` directory instead of the socket file inside it, so
   users not yet in the `fips` group get a clear "Permission denied"