docs: refresh tutorials, how-to, design, reference, and examples for v0.4.0

Pre-cut documentation pass for the 0.4.0 release, verified against current source.

Corrections:
- fipsctl: stale 'show identities'/'show node' -> 'show status'
  (host-a-service, run-as-unprivileged-user)
- mesh address derivation: first 16 bytes of SHA-256(pubkey) with the leading
  byte set to 0xfd, not a fixed fd97: prefix (reach-mesh-services,
  ipv6-adapter-walkthrough)
- gateway control socket mode 0660 -> 0770 (troubleshoot-gateway)
- Tor example: add advertised_port: 8443 so the published port matches the
  prose (enable-nostr-discovery)
- bloom mesh-size estimate rewritten to the OR-union-of-peer-filters algorithm;
  plus mtu deep-link, gateway pool wording, and a NAT failure-mode line
- examples: delete orphaned nostr-rs-relay config, accept inbound to the local
  8443 TCP listener, fix fd::/8 -> fd00::/8 typos, dotless wireguard alias

Additions:
- new Nym mixnet transport section (fips-transport-layer) and the architecture
  transport list
- new LAN/mDNS discovery section (fips-nostr-discovery)
- reference docs: Nym transport, LAN discovery, and new control/stats surfaces;
  drop ble from the connect transport list

docs/tutorials/ipv6-adapter-walkthrough.md

@@ -63,9 +63,11 @@ mesh address:
 dig npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98.fips AAAA +short
 ```
 
-You should see one AAAA record returning a `fd97:...` address.
-The prefix is the FIPS ULA range (`fd00::/8`, with `fd97:...`
-covering the address space derived from npubs).
+You should see one AAAA record returning an address such as
+`fd97:...`. The prefix is the FIPS ULA range (`fd00::/8`): only
+the leading `fd` byte is fixed, and everything after it is hash
+output derived from the npub, so the digits beyond `fd` vary per
+node.
 
 The query went through `systemd-resolved` (or your platform
 equivalent), which routed `.fips` queries to the daemon's local