Truncate NodeAddr from 32 bytes to 16 bytes (first 128 bits of SHA-256)

128-bit truncated SHA-256 provides adequate collision resistance
(2^64 birthday bound, 2^128 pre-image) while cutting per-packet
header overhead nearly in half, aligning with Yggdrasil's approach
and IPv6 address size.

Code changes:
- NodeAddr inner type [u8; 32] → [u8; 16], from_pubkey takes first 16 bytes
- DATA_HEADER_SIZE 68 → 36, signing_bytes capacity 80 → 48
- proof_bytes capacity 40 → 24
- Updated all make_node_addr test helpers and size assertion tests

Doc changes:
- All wire format tables and offset calculations updated
- AncestryEntry size 112 → 96 bytes
- Packet size examples recalculated throughout

docs/design/fips-architecture.md

@@ -46,7 +46,7 @@ Cryptographic identity using Nostr keys (secp256k1).
 Identity
 ├── npub: PublicKey                 // public key (bech32: npub1...)
 ├── nsec: SecretKey                 // secret key (bech32: nsec1...)
-├── node_addr: NodeAddr                 // SHA-256(pubkey), 32 bytes
+├── node_addr: NodeAddr                 // SHA-256(pubkey) truncated, 16 bytes
 └── address: FipsAddress            // IPv6 ULA derived from node_addr (fd::/8)
 ```