proto/fsp: extract FSP session protocol into sans-IO layout, retire src/protocol

Migrate the FSP end-to-end session subsystem into src/proto/fsp/ following the
established sans-IO shape, and retire the src/protocol grab-bag now that FSP was
its last occupant.

Relocate the FSP session wire (node/session_wire.rs plus the FSP message types
from protocol/session.rs) into proto/fsp/wire.rs. Hoist the pure decision logic
into proto/fsp/core.rs over plain-data SessionSnapshots returning an ordered
FspAction list the shell drives: session-rekey policy, msg3-resend
classification, post-decrypt epoch reaction, setup/dual-init tie-break,
coords/path-MTU emit-policy, bounded pending-queue, and IPv6 ECN. The
crypto-owning SessionEntry stays shell-side in node/session.rs (matching the FMP
ActivePeer pattern); proto/fsp is wire + core + limits only, with no proto->noise
dependency and no crypto.

Move the coords helpers to proto/stp/ (they serialize TreeCoordinate), and split
SessionMessageType: the encrypted-inner 0x10-0x1F variants stay in proto/fsp/wire.rs
while the 0x20-0x2F routing signals become a new RoutingSignalType in
proto/routing/wire.rs. Migrate the session-MMP shell adapter, which continues to
drive proto/mmp/.

Retire src/protocol: LinkMessageType and SessionDatagram move to a new shared
proto/link.rs, ProtocolError becomes proto::Error (relocated verbatim), the
deprecated MessageType alias and the unimported PROTOCOL_VERSION are dropped, and
src/protocol/ is deleted along with its lib.rs module declaration.

Behavior-neutral: wire bytes unchanged, oracle tests pass unedited except
mod-path relocation; adds rekey/epoch characterization tests and pure
poll/emit-policy core tests.

src/node/mod.rs

@@ -19,7 +19,6 @@ pub(crate) mod reject;
 mod reloadable;
 mod retry;
 pub(crate) mod session;
-pub(crate) mod session_wire;
 pub(crate) mod stats;
 pub(crate) mod stats_history;
 #[cfg(test)]
@@ -46,6 +45,7 @@ use crate::peer::{ActivePeer, PeerConnection};
 use crate::proto::bloom::{BloomFilter, BloomState};
 use crate::proto::discovery::{Discovery, DiscoveryBackoff, DiscoveryForwardRateLimiter};
 use crate::proto::fmp::Fmp;
+use crate::proto::fsp::Fsp;
 use crate::proto::mmp::Mmp;
 use crate::proto::routing::{self, Router, RoutingErrorRateLimiter};
 use crate::proto::stp::TreeState;
@@ -421,6 +421,9 @@ pub struct Node {
     /// FMP connection-lifecycle decision anchor (stateless; drives the
     /// tick-poll maintain/teardown decisions).
     fmp: Fmp,
+    /// FSP session-lifecycle decision anchor (stateless; drives the rekey /
+    /// epoch-reaction decisions).
+    fsp: Fsp,
     /// MMP reporting decision anchor (stateless; drives the report-fan-out /
     /// liveness / heartbeat decisions).
     mmp: Mmp,
@@ -670,6 +673,7 @@ impl Node {
             icmp_rate_limiter: IcmpRateLimiter::new(),
             routing: Router::new(),
             fmp: Fmp::new(),
+            fsp: Fsp::new(),
             mmp: Mmp::new(),
             coords_response_rate_limiter: RoutingErrorRateLimiter::with_interval_ms(
                 coords_response_interval_ms,
@@ -834,6 +838,7 @@ impl Node {
             icmp_rate_limiter: IcmpRateLimiter::new(),
             routing: Router::new(),
             fmp: Fmp::new(),
+            fsp: Fsp::new(),
             mmp: Mmp::new(),
             coords_response_rate_limiter: RoutingErrorRateLimiter::with_interval_ms(
                 coords_response_interval_ms,