Add Nym mixnet transport and single-container demo

Add an outbound-only Nym mixnet transport that tunnels FMP peer links
through a local nym-socks5-client SOCKS5 proxy into the Nym mixnet. It
structurally mirrors the Tor SOCKS5 transport (connection pool,
connect-on-send background promotion, FMP-v0 framing reused from TCP)
with the onion, inbound-listener, and control-port machinery removed.

Wires the transport through the full TransportHandle dispatch, NymConfig
(standard transport-instance pattern), and node instantiation, and
surfaces its counters in fipstop. Includes a mock SOCKS5 harness and unit
coverage for the address-parsing paths.

Also adds an isolated single-container example
(examples/sidecar-nostr-mixnet-relay/) demonstrating FIPS peering across
the mixnet end to end. No new crate dependencies: tokio_socks, socket2,
and futures are already pulled in by the Tor transport.

src/node/mod.rs

@@ -50,6 +50,7 @@ use crate::node::session::SessionEntry;
 use crate::peer::{ActivePeer, PeerConnection};
 #[cfg(unix)]
 use crate::transport::ethernet::EthernetTransport;
+use crate::transport::nym::NymTransport;
 use crate::transport::tcp::TcpTransport;
 use crate::transport::tor::TorTransport;
 use crate::transport::udp::UdpTransport;
@@ -982,6 +983,21 @@ impl Node {
             transports.push(TransportHandle::Tor(tor));
         }
 
+        // Create Nym transport instances
+        let nym_instances: Vec<_> = self
+            .config()
+            .transports
+            .nym
+            .iter()
+            .map(|(name, config)| (name.map(|s| s.to_string()), config.clone()))
+            .collect();
+
+        for (name, nym_config) in nym_instances {
+            let transport_id = self.allocate_transport_id();
+            let nym = NymTransport::new(transport_id, name, nym_config, packet_tx.clone());
+            transports.push(TransportHandle::Nym(nym));
+        }
+
         // Create BLE transport instances
         #[cfg(bluer_available)]
         {