node: establish dataplane/ and session/ concept homes (behavior-neutral)

Reorganize the node module tree by concept rather than by
message-handling verb, as the first step of the node runtime
decomposition. Pure relocation: no wire, config, metric, or log
semantics change; the lib test count is unchanged (1577 passed).

Moves (git mv, 100% rename similarity):
- handlers/{forwarding,rx_loop,connected_udp,dispatch,encrypted}.rs
  -> node/dataplane/ — the whole RX hot path (the select! run loop,
  transit/local forwarding, the link-message router, the RX decrypt
  path with responder K-bit cutover + roam writes, and connected-UDP
  fast-path activation) now lives in one home.
- node/session.rs -> node/session/mod.rs — establishes the session
  concept home for the data/state types. The message-behavior file
  handlers/session.rs stays put for now (folds in with the later FSP
  session step).

The IK/XX-divergent establishment files (handlers/{handshake,rekey,
timeout}.rs) and the deferred-home files (handlers/{mmp,lookup}.rs)
deliberately stay in handlers/, to move once rather than twice.

Every module is reached through impl Node methods, so no call site or
re-export shim was needed. Updated in lockstep with the moves: the
module_path!-derived tracing targets in the two mesh-lab compose-trace
overlays, a structural test's include_str! source path, doc-comments
in proto/routing and the mesh-lab docs, and the stale source-location
citations (node/handlers/{forwarding,rx_loop,encrypted}.rs and
node/session.rs) in doc-comments and the discovery design doc.

testing/mesh-lab/README.md

@@ -102,7 +102,7 @@ each rep does, set them in the invoking shell:
     `handshake`, `forwarding`, `session`, `encrypted`, `mmp`
     (via `compose-trace.yml`).
   - nat-lan — `discovery::nostr`, `transport::udp`,
-    `node::lifecycle`, `handlers::handshake`, `handlers::forwarding`
+    `node::lifecycle`, `handlers::handshake`, `dataplane::forwarding`
     (via `compose-trace-nat.yml`, picked up by
     `testing/nat/scripts/nat-test.sh` through the
     `FIPS_NAT_EXTRA_COMPOSE` env-var hook).

testing/mesh-lab/compose-trace-nat.yml

@@ -12,7 +12,7 @@
 #                                          cross-init tie-breaker
 #                                          ("Ignoring established NAT
 #                                          traversal..." emits here)
-#   - fips::node::handlers::forwarding  — transit/local datagram routing
+#   - fips::node::dataplane::forwarding — transit/local datagram routing
 #                                          (catches drops post-adoption)
 #
 # Other modules stay at info to keep log volume manageable. The base
@@ -33,7 +33,7 @@
 # is set and the suite is nat-lan.
 
 x-trace-rust-log: &trace-rust-log
-  RUST_LOG: "info,fips::nostr=trace,fips::transport::udp=trace,fips::node::lifecycle=trace,fips::node::handlers::handshake=trace,fips::node::handlers::forwarding=trace"
+  RUST_LOG: "info,fips::nostr=trace,fips::transport::udp=trace,fips::node::lifecycle=trace,fips::node::handlers::handshake=trace,fips::node::dataplane::forwarding=trace"
 
 services:
   lan-a:

testing/mesh-lab/compose-trace.yml

@@ -4,10 +4,10 @@
 #   - fips::node::handlers::rekey       — FMP/FSP rekey state machine
 #   - fips::node::handlers::handshake   — Noise handshake (cross-init,
 #                                          dual-init, msg1/2/3 dispatch)
-#   - fips::node::handlers::forwarding  — transit datagram forwarding,
+#   - fips::node::dataplane::forwarding — transit datagram forwarding,
 #                                          route lookup, drops
 #   - fips::node::handlers::session     — FSP K-bit cutover, drain
-#   - fips::node::handlers::encrypted   — FMP K-bit flip detection
+#   - fips::node::dataplane::encrypted  — FMP K-bit flip detection
 #   - fips::node::handlers::mmp         — link liveness, SRTT, ETX
 #
 # Other modules stay at info to keep log volume manageable. The base
@@ -33,7 +33,7 @@
 # environment variable FIPS_MESH_LAB_TRACE=1 is set.
 
 x-trace-rust-log: &trace-rust-log
-  RUST_LOG: "info,fips::node::handlers::rekey=trace,fips::node::handlers::handshake=trace,fips::node::handlers::forwarding=trace,fips::node::handlers::session=trace,fips::node::handlers::encrypted=trace,fips::node::handlers::mmp=trace"
+  RUST_LOG: "info,fips::node::handlers::rekey=trace,fips::node::handlers::handshake=trace,fips::node::dataplane::forwarding=trace,fips::node::handlers::session=trace,fips::node::dataplane::encrypted=trace,fips::node::handlers::mmp=trace"
 
 services:
   # rekey profile

testing/mesh-lab/run-loop.sh

@@ -429,7 +429,7 @@ run_nat_lan() {
     # nat-test.sh at the nat-specific trace overlay via the
     # FIPS_NAT_EXTRA_COMPOSE env-var hook in nat-test.sh. The overlay
     # bumps RUST_LOG to trace on discovery::nostr, transport::udp,
-    # node::lifecycle, handlers::handshake, handlers::forwarding —
+    # node::lifecycle, handlers::handshake, dataplane::forwarding —
     # the modules covering the cross-init / adoption / handshake
     # path that the NAT-traversal flake exhibits. Path is repo-relative.
     local -a env_args=(FIPS_NAT_SKIP_FINAL_CLEANUP=1)