node: route receive-path silent-rejection sites through typed RejectReason counters

Introduce a typed RejectReason enum and a NodeStats::record_reject
dispatch so every receive-path rejection-and-return site bumps a
machine-readable per-subsystem counter while keeping its operator-facing
log line. The top-level variants mirror the existing NodeStats subsystem
split (Tree, Bloom, Discovery, Forwarding) and add Handshake, Session,
Mmp, and Transport categories; HandshakeStats, SessionStats, and MmpStats
are new sub-stats.

Wired clusters: tree and MMP outbound sign-failure; the FSP session
unknown-session and state-machine cluster; the Noise IK handshake
state-machine cluster (msg1/msg2); and the decode / crypto / cap /
semantic tail across bloom, discovery, forwarding, mmp, and tree. The
TreeStats::ancestry_invalid counter, present since the scaffold but never
incremented, is now bumped from the validate_semantics ancestry rejection.
Several handshake, MMP, tree, and discovery paths that previously had no
counter at all are now counted, including the send_lookup_response
no-route drop (DiscoveryStats::resp_no_route).

Existing direct counters at the bloom / discovery / forwarding sites are
retained alongside the new dispatch while the rollout is in progress (the
bloom_poison tests expect the transitional +2 delta); a later change
collapses the duplicate increment.

src/node/tree.rs

@@ -8,6 +8,7 @@ use std::collections::HashMap;
 use crate::NodeAddr;
 use crate::protocol::TreeAnnounce;
 
+use super::reject::{RejectReason, TreeReject};
 use super::{Node, NodeError};
 use tracing::{debug, info, trace, warn};
 
@@ -173,6 +174,8 @@ impl Node {
         }
 
         if let Err(e) = announce.validate_semantics() {
+            self.stats_mut()
+                .record_reject(RejectReason::Tree(TreeReject::AncestryInvalid));
             warn!(
                 from = %self.peer_display_name(from),
                 error = %e,
@@ -248,6 +251,8 @@ impl Node {
             self.tree_state.recompute_coords();
             if let Err(e) = self.tree_state.sign_declaration(&self.identity) {
                 warn!(error = %e, "Failed to sign declaration after parent switch");
+                self.stats_mut()
+                    .record_reject(RejectReason::Tree(TreeReject::OutboundSignFailed));
                 return;
             }
             // Surgical invalidation — see CoordCache::invalidate_via_node doc.
@@ -281,6 +286,8 @@ impl Node {
             self.tree_state.become_root();
             if let Err(e) = self.tree_state.sign_declaration(&self.identity) {
                 warn!(error = %e, "Failed to sign self-root declaration");
+                self.stats_mut()
+                    .record_reject(RejectReason::Tree(TreeReject::OutboundSignFailed));
                 return;
             }
             // Surgical invalidation — see CoordCache::invalidate_other_roots doc.
@@ -317,6 +324,8 @@ impl Node {
                 if self.tree_state.handle_parent_lost(&peer_costs) {
                     if let Err(e) = self.tree_state.sign_declaration(&self.identity) {
                         warn!(error = %e, "Failed to sign declaration after loop detection");
+                        self.stats_mut()
+                            .record_reject(RejectReason::Tree(TreeReject::OutboundSignFailed));
                         return;
                     }
                     // handle_parent_lost may promote to root OR find new parent;
@@ -357,6 +366,8 @@ impl Node {
             self.tree_state.recompute_coords();
             if let Err(e) = self.tree_state.sign_declaration(&self.identity) {
                 warn!(error = %e, "Failed to sign declaration after parent update");
+                self.stats_mut()
+                    .record_reject(RejectReason::Tree(TreeReject::OutboundSignFailed));
                 return;
             }
             // Surgical invalidation — see CoordCache::invalidate_via_node doc.
@@ -448,6 +459,8 @@ impl Node {
             self.tree_state.recompute_coords();
             if let Err(e) = self.tree_state.sign_declaration(&self.identity) {
                 warn!(error = %e, "Failed to sign declaration after periodic parent re-eval");
+                self.stats_mut()
+                    .record_reject(RejectReason::Tree(TreeReject::OutboundSignFailed));
                 return;
             }
             // Surgical invalidation — see CoordCache::invalidate_via_node doc.
@@ -479,6 +492,8 @@ impl Node {
             self.tree_state.become_root();
             if let Err(e) = self.tree_state.sign_declaration(&self.identity) {
                 warn!(error = %e, "Failed to sign self-root declaration in periodic reeval");
+                self.stats_mut()
+                    .record_reject(RejectReason::Tree(TreeReject::OutboundSignFailed));
                 return;
             }
             // Surgical invalidation — see CoordCache::invalidate_other_roots doc.
@@ -539,6 +554,8 @@ impl Node {
                 // Re-sign the new declaration
                 if let Err(e) = self.tree_state.sign_declaration(&self.identity) {
                     warn!(error = %e, "Failed to sign declaration after parent loss");
+                    self.stats_mut()
+                        .record_reject(RejectReason::Tree(TreeReject::OutboundSignFailed));
                 }
                 info!(
                     new_root = %self.tree_state.root(),