Merge branch 'refactor-transport' into refactor-next

Brings the connected-UDP fast-path plane relocation (ConnectedPeerSocket/
PeerRecvDrain into peer/connected_udp; udp keeps open_connected_fd in io.rs)
and the darwin_sockopts -> sockopts_macos rename onto the next line. Clean
three-way auto-merge; behavior-neutral.

src/node/encrypt_worker.rs

@@ -132,8 +132,7 @@ pub(crate) struct FmpSendJob {
     /// the job completes and the worker drops it, only the peer's
     /// strong ref remains.
     #[cfg(any(target_os = "linux", target_os = "macos"))]
-    pub connected_socket:
-        Option<std::sync::Arc<crate::transport::udp::connected_peer::ConnectedPeerSocket>>,
+    pub connected_socket: Option<std::sync::Arc<crate::peer::connected_udp::ConnectedPeerSocket>>,
     /// Bulk endpoint data may be dropped when the kernel reports UDP
     /// send-queue exhaustion. Control/rekey frames keep retrying so
     /// congestion cannot strand the session.
@@ -716,8 +715,7 @@ fn mac_now_ms() -> u64 {
 struct MacSequencedSendFlow {
     key: MacSendFlowKey,
     socket: AsyncUdpSocket,
-    connected_socket:
-        Option<std::sync::Arc<crate::transport::udp::connected_peer::ConnectedPeerSocket>>,
+    connected_socket: Option<std::sync::Arc<crate::peer::connected_udp::ConnectedPeerSocket>>,
     dest_addr: SocketAddr,
     next_seq: std::sync::atomic::AtomicU64,
     last_used_ms: std::sync::atomic::AtomicU64,
@@ -754,9 +752,7 @@ impl MacSequencedSendFlow {
     fn spawn(
         key: MacSendFlowKey,
         socket: AsyncUdpSocket,
-        connected_socket: Option<
-            std::sync::Arc<crate::transport::udp::connected_peer::ConnectedPeerSocket>,
-        >,
+        connected_socket: Option<std::sync::Arc<crate::peer::connected_udp::ConnectedPeerSocket>>,
         dest_addr: SocketAddr,
         now_ms: u64,
     ) -> Arc<Self> {
@@ -1024,8 +1020,7 @@ fn flush_batch_sync(
     struct EncryptedGroup {
         socket: AsyncUdpSocket,
         #[cfg(any(target_os = "linux", target_os = "macos"))]
-        connected_socket:
-            Option<std::sync::Arc<crate::transport::udp::connected_peer::ConnectedPeerSocket>>,
+        connected_socket: Option<std::sync::Arc<crate::peer::connected_udp::ConnectedPeerSocket>>,
         dest_addr: SocketAddr,
         wire_packets: Vec<Vec<u8>>,
         drop_on_backpressure: bool,

src/node/handlers/connected_udp.rs

@@ -142,20 +142,24 @@ impl Node {
             (peer_sa, local, recv_buf, send_buf, tx)
         };
 
-        // Open the connected socket on the kernel side.
-        let socket = std::sync::Arc::new(
-            crate::transport::udp::connected_peer::ConnectedPeerSocket::open(
-                local_addr,
-                peer_socket_addr,
-                recv_buf,
-                send_buf,
-            )
-            .map_err(|e| format!("ConnectedPeerSocket::open: {e}"))?,
-        );
+        // Open the connected socket on the kernel side, then adopt the
+        // fd into the owning handle.
+        let owned = crate::transport::udp::open_connected_fd(
+            local_addr,
+            peer_socket_addr,
+            recv_buf,
+            send_buf,
+        )
+        .map_err(|e| format!("open_connected_fd: {e}"))?;
+        let socket = std::sync::Arc::new(crate::peer::connected_udp::ConnectedPeerSocket::from_fd(
+            owned,
+            peer_socket_addr,
+            local_addr,
+        ));
 
         // Spawn the drain thread. It feeds `packet_tx` exactly like
         // the wildcard listen socket — rx_loop dispatches identically.
-        let drain = crate::transport::udp::peer_drain::PeerRecvDrain::spawn(
+        let drain = crate::peer::connected_udp::PeerRecvDrain::spawn(
             socket.clone(),
             transport_id,
             peer_socket_addr,