docs: refresh tutorials, how-to, design, reference, and examples for v0.4.0

Pre-cut documentation pass for the 0.4.0 release, verified against current source.

Corrections:
- fipsctl: stale 'show identities'/'show node' -> 'show status'
  (host-a-service, run-as-unprivileged-user)
- mesh address derivation: first 16 bytes of SHA-256(pubkey) with the leading
  byte set to 0xfd, not a fixed fd97: prefix (reach-mesh-services,
  ipv6-adapter-walkthrough)
- gateway control socket mode 0660 -> 0770 (troubleshoot-gateway)
- Tor example: add advertised_port: 8443 so the published port matches the
  prose (enable-nostr-discovery)
- bloom mesh-size estimate rewritten to the OR-union-of-peer-filters algorithm;
  plus mtu deep-link, gateway pool wording, and a NAT failure-mode line
- examples: delete orphaned nostr-rs-relay config, accept inbound to the local
  8443 TCP listener, fix fd::/8 -> fd00::/8 typos, dotless wireguard alias

Additions:
- new Nym mixnet transport section (fips-transport-layer) and the architecture
  transport list
- new LAN/mDNS discovery section (fips-nostr-discovery)
- reference docs: Nym transport, LAN discovery, and new control/stats surfaces;
  drop ble from the connect transport list

docs/how-to/enable-nostr-discovery.md

@@ -284,6 +284,7 @@ transports:
   tor:
     mode: directory
     socks5_addr: "127.0.0.1:9050"
+    advertised_port: 8443
     directory_service:
       hostname_file: "/var/lib/tor/fips/hostname"
       bind_addr: "127.0.0.1:8444"

docs/how-to/run-as-unprivileged-user.md

@@ -169,7 +169,7 @@ sudo usermod -aG fips $USER
 Then:
 
 ```sh
-fipsctl show node
+fipsctl show status
 ```
 
 ## Caveats

docs/how-to/troubleshoot-gateway.md

@@ -151,7 +151,7 @@ rather than `flush ruleset`, which destroys every table on the host.
 Symptom: `nc -U /run/fips/gateway.sock` fails with "Permission
 denied" or "No such file or directory".
 
-The socket is owned by root with mode `0660` (group `fips`). Either
+The socket is owned by root with mode `0770` (group `fips`). Either
 run `nc` as root (`sudo nc -U ...`) or add your user to the `fips`
 group and re-login. If the file does not exist at all, the gateway
 either failed to start (check `journalctl -u fips-gateway`) or