Add diagnostic queries for security validation and mesh debugging

Extend the fipsctl control query interface with visibility into internal
state critical for protocol security auditing, mesh troubleshooting, and
operational monitoring.

New command:

  fipsctl show identity-cache

    Lists every node identity cached by the daemon (learned from DNS
    resolution, peer handshakes, sessions, and static config).  Shows
    npub, IPv6 address, display name, and LRU age alongside the
    configured cache capacity.

Extended queries:

  show peers — Noise session counters (send_counter, highest received
    counter) for rekey urgency assessment.  Per-peer replay suppression
    and consecutive decrypt failure counts for active attack detection.
    Session index visibility for hijack analysis.  Rekey lifecycle
    state (in_progress, draining, K-bit epoch).

  show sessions — Handshake resend count during establishment for
    connectivity debugging.  Rekey and session health fields
    (session_start, K-bit, coords warmup, drain state) when
    established.

  show cache — Individual coordinate cache entries with tree
    coordinates, depth, path MTU, and age.  Enables route-level
    debugging by showing exactly which destinations have cached
    routes and via what tree path.  Renames the top-level count
    field from "entries" to "count" for clarity.

  show routing — Pending discovery lookups expanded from count to
    per-target detail (attempt number, age, last sent).  Pending
    TUN packet queue depth for backpressure visibility.  Connection
    retry state per peer (retry count, next attempt, auto-reconnect
    flag).

Updates fipstop to match the revised show_cache and show_routing
response schemas.  Updates README monitoring section with the complete
fipsctl command list.

Co-authored-by: Johnathan Corgan <johnathan@corganlabs.com>

src/node/mod.rs

@@ -1425,16 +1425,55 @@ impl Node {
         self.identity_cache.len()
     }
 
+    /// Iterate over identity cache entries.
+    ///
+    /// Returns `(NodeAddr, PublicKey, last_seen_ms)` for each cached identity.
+    /// Used by the `show_identity_cache` control query.
+    pub fn identity_cache_iter(
+        &self,
+    ) -> impl Iterator<Item = (&NodeAddr, &secp256k1::PublicKey, u64)> {
+        self.identity_cache
+            .values()
+            .map(|(addr, pk, ts)| (addr, pk, *ts))
+    }
+
+    /// Configured maximum identity cache size.
+    pub fn identity_cache_max(&self) -> usize {
+        self.config.node.cache.identity_size
+    }
+
     /// Number of pending discovery lookups.
     pub fn pending_lookup_count(&self) -> usize {
         self.pending_lookups.len()
     }
 
+    /// Iterate over pending discovery lookups for diagnostics.
+    pub fn pending_lookups_iter(
+        &self,
+    ) -> impl Iterator<Item = (&NodeAddr, &handlers::discovery::PendingLookup)> {
+        self.pending_lookups.iter()
+    }
+
     /// Number of recent discovery requests tracked.
     pub fn recent_request_count(&self) -> usize {
         self.recent_requests.len()
     }
 
+    /// Count of destinations with queued TUN packets awaiting session setup.
+    pub fn pending_tun_destinations(&self) -> usize {
+        self.pending_tun_packets.len()
+    }
+
+    /// Total TUN packets queued across all destinations.
+    pub fn pending_tun_total_packets(&self) -> usize {
+        self.pending_tun_packets.values().map(|q| q.len()).sum()
+    }
+
+    /// Iterate over retry state for diagnostics.
+    pub fn retry_state_iter(&self) -> impl Iterator<Item = (&NodeAddr, &retry::RetryState)> {
+        self.retry_pending.iter()
+    }
+
     // === Routing ===
 
     /// Check if a peer is a tree neighbor (parent or child in the spanning tree).